Respond to authoratative CPEs from catalogers

[wagoodman]

Today if a cataloger happens to find a CPE and attach it to the package, and we're configured to generate CPEs, we blindly add additional CPEs next to the other CPEs found. In reality, if the cataloger already has found an authoritative CPE, we should prefer that value over any we would typically generate --this PR changes the behavior to this.

Before:

❯ go run ./cmd/syft ~/scratch/curl -o json | jq '.artifacts[] '
{
  "id": "0d29b58484d4ecfb",
  "name": "curl",
  "version": "8.9.1",
  "type": "binary",
  "foundBy": "binary-classifier-cataloger",
  ...
  "cpes": [
    {
      "cpe": "cpe:2.3:a:haxx:curl:8.9.1:*:*:*:*:*:*:*",
      "source": "nvd-cpe-dictionary"
    },
    {
      "cpe": "cpe:2.3:a:curl:curl:8.9.1:*:*:*:*:*:*:*",
      "source": "syft-generated"
    }
  ],
  "purl": "pkg:generic/curl@8.9.1",
  "metadataType": "binary-signature",
  ...
}

After:

❯ go run ./cmd/syft ~/scratch/curl -o json | jq '.artifacts[] '
{
  "id": "0d29b58484d4ecfb",
  "name": "curl",
  "version": "8.9.1",
  "type": "binary",
  "foundBy": "binary-classifier-cataloger",
  ...
  "cpes": [
    {
      "cpe": "cpe:2.3:a:haxx:curl:8.9.1:*:*:*:*:*:*:*",
      "source": "nvd-cpe-dictionary"
    }
  ],
  "purl": "pkg:generic/curl@8.9.1",
  "metadataType": "binary-signature",
  ...
}