Report each hardlink as its own file when scanning images

[wagoodman]

Image scans previously collapsed a set of hardlinks onto a single file, so only one path per inode showed up in results. Directory scans report every hardlink path, which made image vs dir SBOMs of the same filesystem diverge (and produce different SPDX packageVerificationCode values for packages that own hardlinked files).

Now both image resolvers (squash and all-layers) surface each hardlink at its own path as a regular file bound to the target's content, matching dir scans.

user-facing impact:

• SBOMs for images containing hardlinks will list more file entries
• SPDX packageVerificationCode values change for affected packages, now matching the equivalent dir: scan
• adds file.NewVirtualLocationFromImage to the public API

Note

This does NOT address the FilesByMIMEType and other non-path based queries against the container based file resolvers. This means that though pathing/globbing will return multiple entries (for all og and hardlink types) others will only respond to regular files strictly.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

fixes #5019