feat: container scan support for cgo and stripped Go binaries

[adrobuta]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Upgrades snyk-docker-plugin to add support for detecting CGO-linked and stripped Go binaries in container images. Previously, these binaries could not be analyzed for dependencies. With this update, snyk container will identify and report on Go applications compiled with CGO or built with stripped symbols.

Where should the reviewer start?

• package.json - dependency version bump
• Acceptance tests for the new CGO/stripped binary detection

How should this be manually tested?

Run snyk container test against a container image containing a CGO-compiled or stripped Go binary and verify the binary is detected and analyzed. Here is an example of scanning docker.elastic.co/beats/filebeat:8.11.0 public image:

SNYK_API=https://app.snyk.io/api/v1 node index.js container test  docker.elastic.co/beats/filebeat:8.11.0
Organization:      dummy-org
Package manager:   gomodules
Target file:       /usr/share/filebeat/filebeat
Project name:      github.com/elastic/beats/v7
Docker image:      docker.elastic.co/beats/filebeat:8.11.0
Licenses:          enabled

Tested 227 dependencies for known issues, found 7 issues.

Tested 2 projects, 2 contained vulnerable paths.

Without this change, we detect only the base image vulnerabilities:

snyk container test docker.elastic.co/beats/filebeat:8.11.0

Organization:      dummy-org
Package manager:   deb
Project name:      docker-image|docker.elastic.co/beats/filebeat
Docker image:      docker.elastic.co/beats/filebeat:8.11.0
Platform:          linux/arm64
Licenses:          enabled

Tested 129 dependencies for known issues, found 78 issues.

What's the product update that needs to be communicated to CLI users?

Snyk Container now supports detection of CGO and stripped Go binaries, improving vulnerability coverage for Go applications in container images.