Go: parse further entries

[orangecms]

Currently, we only get the first swid. A uSWID SBOM within a binary may contain multiple SWIDs.

see https://github.com/hughsie/python-uswid/blob/84c879a720d5cb7a2f41acc5a7ddbf1aefebc84c/uswid/container.py#L96

see also https://www.rfc-editor.org/rfc/rfc8949.html#section-3-6

If the encoded sequence of bytes ends before the end of a data item, that item is not well-formed. If the encoded sequence of bytes still has bytes remaining after the outermost encoded item is decoded, that encoding is not a single well-formed CBOR item. Depending on the application, the decoder may either treat the encoding as not well-formed or just identify the start of the remaining bytes to the application.

9eSec's uswid pkg is able to parse multiple CBOR blobs:
https://github.com/9elements/goswid/blob/trunk/pkg/uswid/uswid.go#L158

[orangecms]

and: https://github.com/fxamacker/cbor/blob/master/decode.go#L70

// To unmarshal a CBOR map into a map, Unmarshal allocates a new map only if the
// map is nil.  Otherwise Unmarshal reuses the existing map and keeps existing
// entries.  Unmarshal stores key-value pairs from the CBOR map into Go map.
// See DecOptions.DupMapKey to enable duplicate map key detection.

Note: We do not get length information on how many bytes were processed. How do we figure this out? File an issue on https://github.com/fxamacker/cbor/issues, probably.