Upgrade syft version to v0.63.0

[jedevc]

See https://github.com/anchore/syft/releases/tag/v0.63.0.

[jedevc]

Tested this on moby/buildkit#3405, can see a total size reduction in files.

Before:

$ ls -lh old/*
old/linux_amd64:
total 62M
-rw-r--r-- 1 jedevc jedevc  62M Dec 15 11:58 buildkit-v0.11.0-rc2-3-g4e6709a67.linux-amd64.tar.gz
-rw------- 1 jedevc jedevc  33K Dec 15 11:59 provenance.json
-rw------- 1 jedevc jedevc 175K Dec 15 11:59 sbom-binaries.spdx.json
-rw------- 1 jedevc jedevc  642 Dec 15 11:59 sbom.spdx.json

old/linux_arm64:
total 59M
-rw-r--r-- 1 jedevc jedevc  58M Dec 15 11:58 buildkit-v0.11.0-rc2-3-g4e6709a67.linux-arm64.tar.gz
-rw------- 1 jedevc jedevc  33K Dec 15 11:59 provenance.json
-rw------- 1 jedevc jedevc 174K Dec 15 11:59 sbom-binaries.spdx.json
-rw------- 1 jedevc jedevc  641 Dec 15 11:59 sbom.spdx.json

After:

$ ls -lh new/*
new/linux_amd64:
total 62M
-rw-r--r-- 1 jedevc jedevc  62M Dec 15 11:58 buildkit-v0.11.0-rc2-3-g4e6709a67.linux-amd64.tar.gz
-rw------- 1 jedevc jedevc  33K Dec 15 11:59 provenance.json
-rw------- 1 jedevc jedevc 152K Dec 15 11:59 sbom-binaries.spdx.json
-rw------- 1 jedevc jedevc  591 Dec 15 11:59 sbom.spdx.json

new/linux_arm64:
total 59M
-rw-r--r-- 1 jedevc jedevc  58M Dec 15 11:58 buildkit-v0.11.0-rc2-3-g4e6709a67.linux-arm64.tar.gz
-rw------- 1 jedevc jedevc  33K Dec 15 11:59 provenance.json
-rw------- 1 jedevc jedevc 151K Dec 15 11:59 sbom-binaries.spdx.json
-rw------- 1 jedevc jedevc  591 Dec 15 11:59 sbom.spdx.json

The small SBOMs seem to be caused by the removal of invalid relationship pairs (the target spdx id wasn't present in the doc). I can't work out which syft fix picked up the issue, but it now seems resolved.

Definitely a note that we need to watch the stability of the output over time - ideally we should have some sort of regression job to compare the output of the scanner over time, over a number of projects.