Go binary version not detected when built with -trimpath

[knqyf263]

Description

When scanning Go binaries built with -trimpath, Trivy fails to detect the main module version. This is because Go does not record -ldflags in the binary's buildinfo when -trimpath is used, due to a known Go bug (golang/go#63432).

Affected Images

The following popular Docker images are affected (non-exhaustive):

Image	Module	Expected Version
grafana/grafana	github.com/grafana/grafana	12.3.3
hashicorp/boundary	github.com/hashicorp/boundary	0.21.1
quay.io/oauth2-proxy/oauth2-proxy	github.com/oauth2-proxy/oauth2-proxy/v7	v7.14.2
calico/node	github.com/projectcalico/calico	v3.21.1
calico/cni	github.com/projectcalico/calico	v3.21.1
lscr.io/linuxserver/syncthing	github.com/syncthing/syncthing	v2.0.14

Reproduction

$ trivy image --format json grafana/grafana:latest | jq '.Results[].Packages[] | select(.Name == "github.com/grafana/grafana") | {Name, Version}'
{
  "Name": "github.com/grafana/grafana",
  "Version": null
}

The version is null because:

1. BuildInfo.Main.Version is (devel) (built from source, not go install)
2. -trimpath=true is set in build settings
3. -ldflags is absent from BuildInfo.Settings due to golang/go#63432

Expected Behavior

Trivy should detect the version (e.g., 12.3.3 for Grafana) by using the ELF symbol table as a fallback.

When Go compiles with -ldflags "-X main.version=1.0.0", the linker creates .str-suffixed symbols (e.g., main.version.str) in the ELF symbol table. These symbols remain intact regardless of -trimpath and can be read directly.