Add support for the Bottlerocket Linux distribution

[0intro]

Description

It would be interesting to add support for the Bottlerocket Linux distribution.

The Bottlerocket distribution is a bit unusual, because, once built, the root file system is immutable. Consequently, Bottlerocket doesn't rely on a package manager in the traditional sense.

However, the Bottlerocket root file system contains a Software Inventory in a JSON format (application-inventory.json) for security purposes. The Bottlerocket maintainers also provide a publicly available Security Advisories database, which is meant to be used to match security vulnerabilities with the package and versions from the Software Inventory.

The Software Inventory and Security Advisories are described in the Bottlerocket documentation.

Target

Filesystem

Scanner

Vulnerability

[0intro]

A PR implementing the parsing of application-inventory.json is available here: #8653.