Track executables with setuid and setgid flags

[prabhu]

In container SBOMs, cdxgen will now track executables with setuid and setgid bits.

The property names are internal:has_setuid and internal:has_setgid.

{
      "name": "ps",
      "type": "file",
      "purl": "pkg:generic/ps",
      "bom-ref": "pkg:generic/ps",
      "hashes": [
        {
          "alg": "MD5",
          "content": "ad3c7574d6c79888c0c1603e5d131016"
        },
        {
          "alg": "SHA-1",
          "content": "5f8f7fa276da206cec1d6df090200ddeca599a11"
        }
      ],
      "properties": [
        {
          "name": "SrcFile",
          "value": "/bin/ps"
        },
        {
          "name": "internal:is_executable",
          "value": "true"
        },
        {
          "name": "internal:has_setuid",
          "value": "true"
        }
      ],

SCA tools could use this information to determine reachability, container escape, and file persistence.

[prabhu]

Pass --json-pretty to get pretty printed boms.

[prabhu]

{
      "name": "write",
      "type": "file",
      "purl": "pkg:generic/write",
      "bom-ref": "pkg:generic/write",
      "hashes": [
        {
          "alg": "MD5",
          "content": "bc3f6f1a2729a65e2cd4d02d404fe83a"
        },
        {
          "alg": "SHA-1",
          "content": "0e59fe552179c48b126a3342445a9d53339221f4"
        }
      ],
      "properties": [
        {
          "name": "SrcFile",
          "value": "/usr/bin/write"
        },
        {
          "name": "internal:is_executable",
          "value": "true"
        },
        {
          "name": "internal:has_setgid",
          "value": "true"
        }
      ],