feat(cyclonedx): use evidence.occurrences for file paths instead of FilePath property

[kevglynn]

Description

CycloneDX has a native field for recording where a component was found: evidence.occurrences (available since spec 1.5). Trivy currently records this in a proprietary aquasecurity:trivy:FilePath property instead.

This PR switches CycloneDX output to evidence.occurrences:

• pkg/sbom/io/encode.go: no longer adds the FilePath property to component properties (the file path is already carried in core.Component.Files).
• pkg/sbom/cyclonedx/marshal.go: marshals core.Component.Files paths as evidence.occurrences[].location.
• pkg/sbom/cyclonedx/unmarshal.go: parses evidence.occurrences back into core.Component.Files, so re-scanning a Trivy SBOM preserves file paths.

Backward compatibility

• pkg/sbom/io/decode.go still parses the aquasecurity:trivy:FilePath property, so SBOMs generated by older versions of Trivy keep working. Existing test fixtures using the old property (testdata/happy/bom.json, testdata/happy/group-in-name.json, fanal SBOM testdata, and the fluentd-multiple-lockfiles-cyclonedx.json integration fixture) are intentionally left unchanged so they keep covering this path.
• A new fixture (testdata/happy/evidence-occurrences.json) covers the new path.
• core.PropertyFilePath remains in duplicateProperties in the SPDX marshaler: when an older SBOM is rescanned, reuseExistingBOM() passes the original components (which still contain the property) directly to the marshaler, so the filter is still needed to prevent a duplicate FilePath annotation in SPDX output.
• integration/testdata/fluentd-multiple-lockfiles-short.cdx.json.golden is intentionally not changed: that test scans an old-style SBOM and outputs CycloneDX via reuseExistingBOM(), which passes the original components through unchanged, so the old property is (correctly) preserved in that output.

Before

{
  "purl": "pkg:conda/openssl@1.1.1q",
  "properties": [
    {
      "name": "aquasecurity:trivy:FilePath",
      "value": "miniconda3/envs/testenv/conda-meta/openssl-1.1.1q-h7f8727e_0.json"
    },
    {
      "name": "aquasecurity:trivy:PkgType",
      "value": "conda-pkg"
    }
  ]
}

After

{
  "purl": "pkg:conda/openssl@1.1.1q",
  "properties": [
    {
      "name": "aquasecurity:trivy:PkgType",
      "value": "conda-pkg"
    }
  ],
  "evidence": {
    "occurrences": [
      {
        "location": "miniconda3/envs/testenv/conda-meta/openssl-1.1.1q-h7f8727e_0.json"
      }
    ]
  }
}

(Output of trivy rootfs --format cyclonedx on integration/testdata/fixtures/repo/conda.)

Related issues

• Close enhancement(cyclonedx): use component.evidence.occurrences.location for filapaths and linenumber #9832

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

Made with Cursor

[CLAassistant]

All committers have signed the CLA.