Fix panic on cabal.project.freeze installed constraints dropping all Haskell packages

[Synvoya]

Description

syft panics on real cabal.project.freeze files and drops all Haskell packages from the scan.

Every cabal freeze emits any.<pkg> installed, constraints for GHC boot libraries (base, array, ghc-prim, ...). parseCabalFreeze splits each constraint on " ==" and unconditionally reads fields[1]; an installed line has no " ==", so fields has length 1 and fields[1] panics with index out of range [1]. The per-cataloger recover then swallows the panic and yields zero Haskell packages for the entire scan.

Reproducible on any real freeze file (e.g. cabal init -n && cabal freeze), which is the same repro from the previously-closed #1362 — that fix guarded a different index and the panic simply moved to fields[1].

Fix

Skip constraint lines without a version (len(fields) < 2) so installed boot-lib lines are ignored and the remaining == version packages parse normally.

Test

Extended testdata/cabal.project.freeze with any.array installed, / any.base installed,. The existing exact-set assertion in parse_cabal_freeze_test.go is now a regression guard: it passes only if the installed lines are skipped and every real package still parses. Before the fix the fixture panicked.

[Synvoya]

Heads-up on the red Static analysis check — it isn't from this change. The job failed while pulling a container image from ghcr.io during setup (connection reset by peer on a pkg-containers.githubusercontent.com blob), a transient network error before any linter ran, so there are no findings against the diff. A re-run should clear it. The change itself is gofmt/go vet clean and the Haskell cataloger tests pass. Thanks for the review!

[Synvoya]

The failing Static analysis check didn't actually reach the linters — the job aborted in the download-test-fixture-cache step on a transient ghcr network error (connection reset by peer fetching a blob from pkg-containers.githubusercontent.com), not on anything in this diff. Re-triggering CI via reopen since I don't have re-run permissions. The change is unchanged and gofmt/vet-clean.