Add option to exclude base image components

[jasonpaulos]

This PR makes two changes:

Improve the way components from container images are mapped to layers

Prior to this, the Syft output's "Locations" field was the sole source of a component's file and layer information. This was undesirable because, for packages installed by the system package manager, the only location would be the system package manager database. As a result, any changes to system packages in later layers would result in every system package being mapped to the last layer where the database was modified.

Now, the Syft output's "Metadata.Files" field is used to augment the "Locations" data about files and layers associated with a component, and any known system package manager database files are ignored in favor of other file mappings, if present. This leads to more accurate mappings of components to image layers.

The expected result of this change is that some components which were previously mapped to layers above the base image may now be properly mapped to base image layers.

Add a new option to exclude components which solely originate from the base image when scanning a container image.

The flag --ExcludeBaseImageComponents can be specified to filter out components from the base image.

[Copilot]

Pull request overview

This PR adds a new scan option to exclude components that originate exclusively from base image layers when scanning container images, integrating the filtering into scan result generation and validating behavior with new unit tests.

Changes:

• Added --FilterBaseImageComponents to ScanSettings to enable base-image-only component filtering for container scans.
• Implemented filtering logic in DefaultGraphTranslationService to remove components whose referenced container layers are all marked IsBaseImage.
• Added orchestrator tests covering removal/retention scenarios for base-image-only, mixed-layer, and non-container components.

Show a summary per file

File	Description
test/Microsoft.ComponentDetection.Orchestrator.Tests/Services/DefaultGraphTranslationServiceTests.cs	Adds unit tests validating the new base-image component filtering behavior.
src/Microsoft.ComponentDetection.Orchestrator/Services/GraphTranslation/DefaultGraphTranslationService.cs	Applies the new filtering option during scan result generation and introduces base-image-only detection logic.
src/Microsoft.ComponentDetection.Orchestrator/Commands/ScanSettings.cs	Introduces the new CLI/settings flag FilterBaseImageComponents.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 6

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[Copilot]

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 1

[Copilot]

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 0 new

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.0%. Comparing base (63dafd9) to head (39b2cff).

Additional details and impacted files

@@     Coverage Diff      @@
##   main   #1825   +/-   ##
============================
============================

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 2

[Copilot]

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 0 new

[Copilot]

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Low