SBOM: add a OperatingSystem package to each apk SBOM

[sil2100]

Some CVE scanners, like trivy, might print warnings if OperatingSystem is not defined. Let's define it. But for this, we need access to the os-release file that's on the builder.
No real tests added as I couldn't think of a nice way of testing the runner code.

[sil2100]

Created this PR to export the ParseReleaseData chainguard-dev/apko#1721 . Once it's merged, I'll modify the code here and re-submit for review :)

[sil2100]

Approved! Let me refactor the code and make everything shiny again.

[sergiodj]

This is much better now, thanks @sil2100!

Some tests are failing which is blocking the merge, but I think it's just a matter of adjusting expected outputs.

[sil2100]

One of the failures demonstrated an actual situation that needed handling. Now it should look better!

[sergiodj]

One of the failures demonstrated an actual situation that needed handling. Now it should look better!

Hm, some tests are still failing :-(.

[sil2100]

One of the failures demonstrated an actual situation that needed handling. Now it should look better!

Hm, some tests are still failing :-(.

I think those are unrelated. If you take a look at the failures, they fail due to No rule to make target 'package/logstash-8'. Stop. and similar. It probably needs a different fix, possibly separate PR?

[sergiodj]

LGTM, thanks @sil2100 !