CRAVEX-integration: Integration with SCA Tools - generic framework

[pombredanne]

Create a framework to integrate with SCA tools, with an emphasis on importing SBOMs into ScanCode.io.

[DennisClark]

Some potential issues to address when importing various SBOMs that were generated by various SCA tools:

• Not all SCA tools are good at providing a precise identification of the components/packages in a standard machine-readable way, and do not necessarily support PURL (yet). The import needs to deal with whatever identification is provided and generate a PURL if possible.
• Not all SCA tools are good at identifying Licenses in a standard way, using SPDX identifiers, and getting the license expressions correct. The import needs to work with whatever is provided to improve the license assignments provided in the SBOM, whenever practical.

[tdruez]

Implemented at #1841

This PR adds a framework to easily add support for SCA tools in ScanCode.io

Changes

• Refactor the SCA test module to simplify the addition of new tools.
• Use benchmark.compare_purls to assert the SBOM PURLs CRAVEX-integration: Integration with SCA Tools - generic framework #1726

Documentation:

From the test_integrations_sca_tools.py module:

"""
Test suite for validating ScanCode.io integrations with third-party SCA SBOM tools.

Each test ensures that SBOM files generated by tools such as Anchore Grype,
CycloneDX (cdxgen), osv-scanner, Trivy, SBOM Tool, and more.

Adding new test data
====================

1. Generate an SBOM with the tool you want to test. For example with Trivy:

    trivy image --scanners vuln,license --format cyclonedx \
        --output trivy-alpine-3.17-sbom.json alpine:3.17.0

2. Save the SBOM file under:
    tests/data/integrations-sca/

3. Add expected counts for that SBOM to `TEST_DATA`` below.

Example:
    "trivy-alpine-3.17-sbom.json": {
        "resources": 1,
        "packages": 16,
        "packages_vulnerable": 7,
        "dependencies": 25,
        "purls": [
            "pkg:unknown/alpine@3.17.0",
        ],
    },

   Tip: run the test once without expected values, check the counts from the
   failure messages, then update the dictionary accordingly.

4. Run the test suite:

    ./manage.py test scanpipe.tests.test_integrations_sca

5. Commit both the SBOM file and dictionary entry.
"""