sca: check if runtime dependencies are vendored

This fixes and issue with 288fb15 that
too broadly added dependencies on vendored libraries.

Libreoffice for example picked up a dep to an internal library without
the corresponding provides.

pkg/sca/sca.go

@@ -247,8 +247,9 @@ func generateSharedObjectNameDeps(ctx context.Context, hdl SCAHandle, generated
 
 				for _, soname := range sonames {
 					log.Infof("  found soname %s for %s", soname, path)
-
-					generated.Runtime = append(generated.Runtime, fmt.Sprintf("so:%s", soname))
+					if isInDir(path, libDirs) {
+						generated.Runtime = append(generated.Runtime, fmt.Sprintf("so:%s", soname))
+					}
 				}
 			}