bug: Trivy should overwrite the namespace and distro qualifier for PURLs when the `--distro` flag is used.

[DmitriyLewen]

Description

When the --distro flag is used, we update metadata.OS, but the PURLs for OS packages remain unchanged.

This leads to two problems:

1. OS initially not detected
   If the OS is not detected initially, we keep the package PURLs empty even after overriding the OS via --distro.
   As a result, VEX files cannot be used correctly (see: VEX pkg:identifier fails, because SBOM seems to be missing PURL when --distro alma/9 override is used #9767).
2. OS initially detected
   If the OS is detected initially, there will be a mismatch between metadata.OS and the package PURLs (their namespace and/or distro qualifier).

Proposed solution

After overriding the OS we should recompute and update the PURLs for OS packages, since OS information is part of the PURL itself.

Relevant code:

trivy/pkg/scan/local/service.go

Lines 84 to 88 in 719ea29

	if !lo.IsEmpty(options.Distro) && !lo.IsEmpty(detail.OS) {
	log.Info("Overriding detected OS with provided distro", log.String("detected", detail.OS.String()),
	log.String("provided", options.Distro.String()))
	detail.OS = options.Distro
	}

Discussed in #9767