fix: overwrite OS packages PURLs after overwrite OS

[DmitriyLewen]

Description

This PR fixes an issue where OS package PURLs (Package URLs) were not being updated when the --distro flag is used to override the detected OS. Previously, when Trivy detected one OS version but the user specified a different one via
the distro flag, the package PURLs would still contain the originally detected OS information, creating inconsistency between the overridden OS and the package metadata.

Examples:

1. Override OS
   before:

   ➜  trivy -q image almalinux:9.5 -f json --distro alma/9.6 | jq '{OS: .Metadata.OS, pkg: .Results[].Packages[0].Identifier.PURL}' 
   {
     "OS": {
       "Family": "alma",
       "Name": "9.6"
     },
     "pkg": "pkg:rpm/alma/acl@2.3.1-4.el9?arch=x86_64&distro=alma-9.5"
   }

   after:

   ➜  ./trivy -q image almalinux:9.5 -f json --distro alma/9.6 | jq '{OS: .Metadata.OS, pkg: .Results[].Packages[0].Identifier.PURL}'
   {
     "OS": {
       "Family": "alma",
       "Name": "9.6"
     },
     "pkg": "pkg:rpm/alma/acl@2.3.1-4.el9?arch=x86_64&distro=alma-9.6"
   }

2. Override empty OS
   before:

   ➜  trivy -q image slos-test:latest -f json --distro alma/9.6 | jq '{OS: .Metadata.OS, pkg: .Results[0].Packages[0].Identifier.PURL}' 
   {
     "OS": {
       "Family": "alma",
       "Name": "9.6"
     },
     "pkg": null
   }

   after:

   ➜  ./trivy -q image slos-test:latest -f json --distro alma/9.6 | jq '{OS: .Metadata.OS, pkg: .Results[0].Packages[0].Identifier.PURL}'
   {
     "OS": {
       "Family": "alma",
       "Name": "9.6"
     },
     "pkg": "pkg:rpm/alma/alternatives@1.24-2.slos1?arch=x86_64&distro=alma-9.6"
   }
   

Related issues

• Close bug: Trivy should overwrite the namespace and distro qualifier for PURLs when the --distro flag is used. #9796

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[joda-work]

Is there any estimate when this fix could be merged?

[DmitriyLewen]

Hello @joda-work
We’re currently focused on higher-priority tasks.

Please be patient — we’ll get back to this PR as soon as we have time.

Regards, Dmitriy

[github-actions]

This PR is stale because it has been labeled with inactivity.

[joda-work]

Is there anything I can do to help getting this merged?

[DmitriyLewen]

Hello @joda-work
I added this task to the v0.70.0 milestone.
I hope we will have time to check this issue.