Java archive is listed twice

[tafli]

What happened:
Having a Java archive that is not named as taken from the Maven repository, it is listed as two components when scanning with Syft. One component is recognized as the correct one, the second is named like the file name. Additionally, the wrong component takes its version from the versioning information present in the jar file.

Unfortunately, this naming behavior happens, when using build plugins, namely SBT native packager. It renames dependencies with its full organizational name: jackson-core-2.15.2.jar becomes com.fasterxml.jackson.core.jackson-core-2.15.2.jar.

What you expected to happen:
The component is listed only once, with the correct name and version.

Steps to reproduce the issue:
Download a Java archive from a Maven repo, scan it with Syft (1 component), rename and rescan it (2 components):

$ wget https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.15.2/jackson-core-2.15.2.jar
$ syft jackson-core-2.15.2.jar
 ✔ Indexed file system                                                                                                                               /Users/abos/Downloads
 ✔ Cataloged packages              [1 packages]
NAME          VERSION  TYPE
jackson-core  2.15.2   java-archive

$ mv jackson-core-2.15.2.jar com.fasterxml.jackson.core.jackson-core-2.15.2.jar
$ syft com.fasterxml.jackson.core.jackson-core-2.15.2.jar
 ✔ Indexed file system                                                                                                                               /Users/abos/Downloads
 ✔ Cataloged packages              [2 packages]
NAME                                     VERSION  TYPE
com.fasterxml.jackson.core.jackson-core  2.15.2   java-archive
jackson-core                             2.15.2   java-archive

$ mv com.fasterxml.jackson.core.jackson-core-2.15.2.jar myFancyPackage.jar
$ syft myFancyPackage.jar
 ✔ Indexed file system                                                                                                                               /Users/abos/Downloads
 ✔ Cataloged packages              [2 packages]
NAME            VERSION  TYPE
jackson-core    2.15.2   java-archive
myFancyPackage  2.15.2   java-archive

Anything else we need to know?:
If a Java archive consists only out of META-INF files, the wrong component is shown only:

$ wget https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-starter-web/3.1.3/spring-boot-starter-web-3.1.3.jar
$ syft spring-boot-starter-web-3.1.3.jar
 ✔ Indexed file system                                                                                                                               /Users/abos/Downloads
 ✔ Cataloged packages              [1 packages]
NAME                     VERSION  TYPE
spring-boot-starter-web  3.1.3    java-archive

$ mv spring-boot-starter-web-3.1.3.jar spring-boot.jar
$ syft spring-boot.jar
 ✔ Indexed file system                                                                                                                               /Users/abos/Downloads
 ✔ Cataloged packages              [1 packages]
NAME         VERSION  TYPE
spring-boot  3.1.3    java-archive

Environment:
Application: syft
Version: 0.90.0
BuildDate: 2023-09-11T21:22:00Z
GitCommit: b82c0ff
GitDescription: v0.90.0
Platform: darwin/amd64
GoVersion: go1.21.0
Compiler: gc