feat: centralized image name parsing

[d3vco]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What does this PR do?

Centralizes all OCI image reference parsing in lib/image-reference.ts and uses it everywhere the plugin interprets image reference strings (e.g. nginx:latest, gcr.io/project/nginx:1.23@sha256:...). This removes duplicate regexes and ad-hoc parsing, and keeps behavior consistent across scan, pull, metadata, and dependency tree.

Where should the reviewer start?

1. lib/image-reference.ts: Single source of truth for image string parsing. Derived from CNCF regex.
2. test/lib/image-reference.spec.ts: Tests that define the intended parsing behavior. Copies pre-existing validation tests from tests/lib/utils.spec.ts and adds new tests to validate the component parsing.

Callers:

1. lib/scan.ts: Uses the new validation and appendLatestTagIfMissing logic.
2. lib/analyzer/image-inspector.ts: extractImageDetails refactor (replaced helpers with one parser call + mapping).
3. lib/extractor/image.ts: ImageName constructor refactor to use parseImageReference and map to existing shape.
4. lib/extractor/oci-distribution-metadata.ts: constructOCIDisributionMetadata uses parseImageReference(imageName) instead of @swimlane/docker-reference’s parseAll.
5. lib/dependency-tree/index.ts: Added nameAndVersionFromTargetImage helper to buildTree which uses parseImageReference before falling back to previous logic.

How should this be manually tested?

TODO

Any background context you want to provide?

ImageName Creation
The previous ImageName constructor attempted to deduplicate digests if a digest was included in the image reference string. However, this comparison always fails, meaning that if the image included a pinned digest it would always be added as digests.other. This then results in two duplicate names being created by the getAllNames function. This bug was captured in some of our snapshot tests causing these tests to fail after the bug was corrected. The snapshots have been updated to reflect the corrected behavior.

Dependency Tree Generation
The buildTree function used "ad-hoc" parsing to extract an "imageName" and "version" from the image reference string that are used as the image identifiers in analysis. This PR adds a helper to perform this parsing with a fallback to the previous logic. Tests have been added in test/lib/dependency-tree/index.spec.ts to ensure the fallback did not impact the previous functionality which is reached for archive image references. These tests also make the parsing results more explicit and could be a focus for further improvement.

Removed:

• lib/utils.ts: this was a duplicate source of image string validation.
• @swimlane/docker-reference removed as a dependency, another duplicate sourcce of image string parsing.

What are the relevant tickets?

TODO

Screenshots

N/A

Additional questions

None