Manifests have mismatching file paths compared to GitHub auto-detection

[hicksjacobp]

When using this action (or more specifically, microsoft/component-detection), the generated manifests have a location that mismatches the GitHub auto-detection. This causes duplicate entries in the GitHub dependency graph. For example, please see this screenshot:

Note how this screenshot shows a discrepancy between the two paths for the same artifact - the one found by this action has a leading / character while the one auto-detected by GitHub does not, and therefore GitHub continues to think I have 2 different manifests. I used microsoft/component-detection to confirm the JSON details:

I believe that these lines of code in this repository could be touched to remove the leading / from every locationsFoundAt value:

component-detection-dependency-submission-action/componentDetection.ts

Lines 80 to 81 in 7303e5e

	const pkg = new ComponentDetectionPackage(packageUrl, component.component.id,
	component.isDevelopmentDependency, component.topLevelReferrers, component.locationsFoundAt, component.containerDetailIds, component.containerLayerIds);

While microsoft/component-detection is the software that's producing the initial manifest, I believe this repository is bridging the gap between general dependency manifest generation and specific uploading to GitHub. I believe either this repository should handle this discrepancy, or GitHub's dependency submission API should (but I wouldn't know where to submit such a request).

[ahpook]

👋 Hi from the dependency graph team at GitHub - we are working on improving the deduplication inside DG, such that we'll prefer the user-submitted dependency over the static auto-detection. Would love to get your feedback on it as we get closer to launch and make sure it addresses this problem - I'll update more in the next week or two.

[ljones140]

I believe this PR will fix this #125

I work with @ahpook on GitHub Dependency Graph team.
The leading slashes / are causing us some pain internally so I have removed them