Signed-off-by: guoguangwu <guoguangwug@gmail.com>

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

* main: (26 commits)
  Fill in SPDX originator for all supported package types (#2822)
  chore(deps): bump anchore/sbom-action from 0.15.10 to 0.15.11 (#2821)
  update spdx license list to 3.23 (#2818)
  fix: re-use embedded union reader if possible (#2814)
  feat: index known CPEs for go modules (#2816)
  chore(deps): bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#2812)
  feat: support multiple known CPEs in index (#2813)
  chore(deps): update stereoscope to 8b297badafd5d81fa1187b26ae34dd2a7ce7e425 (#2807)
  chore(deps): bump actions/checkout from 4.1.3 to 4.1.4 (#2809)
  chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.3 to 0.5.4 (#2810)
  Fix removing labels in 'Detect schema changes' job (#2772)
  chore(deps): bump github.com/docker/docker (#2805)
  Display which provider caused which error in output (#2757)
  fix: prefer non-deprecated CPEs and include jenkins plugins from plugins.jenkins.io (#2806)
  feat: index known CPEs for PHP Composer packagist.org packages (#2804)
  chore(deps): bump github/codeql-action from 3.25.1 to 3.25.2 (#2802)
  chore(deps): bump actions/upload-artifact from 4.3.2 to 4.3.3 (#2803)
  fix: improvements to known CPE index construction (#2801)
  fix: exclude known instrumentation jars from being erroneously identified (#2796)
  feat: index known cpes for PHP extensions (#2777)
  ...