deps: update dependency anchore/syft to v1.5.0

[renovate]

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	1.4.1 -> 1.5.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/syft (anchore/syft)

v1.5.0

Compare Source

Added Features

• Add abstraction for adding relationships from package cataloger results [#​2853 @​wagoodman]
• Capture dependencies when parsing SPDX SBOMs [#​2869 @​russellhaering]
• Add python wheel egg relationships [#​2903 @​wagoodman]
• Added functionality to convert major, minor, patch to version [#​2864 @​LaurentGoderre]
• Add support for RPM DB package relationships [#​2872 @​wagoodman]
• Detect fluent-bit binaries [#​2904 #​2905 @​kzantow]
• Add syft config command [#​2598 #​2892 @​kzantow]

Bug Fixes

• Fix DecoderCollection discarding input from non-seekable Readers [#​2878 @​russellhaering]
• Handle GOEXPERIMENTs in go version [#​2893 @​jonjohnsonjr]
• Go Mod Cataloger: Remove Replaced Packages [#​2891 @​russellhaering]
• Use values in relationship To/From fields [#​2871 @​wagoodman]
• Java package names showing up namespaced packages [#​2230]

Additional Changes

• update spdx license list to 3.24.0 [#​2895 @​spiffcs]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.