fix(cyclonedx): dedupe advisory URLs using canonical URIs

[h4r7w3l1]

Description

This PR canonicalizes CycloneDX advisory URLs before deduplication.

CycloneDX advisories were previously deduplicated using raw URL strings. Equivalent URI references from different advisory sources could therefore survive as separate advisory entries when the same advisory URL was provided using different path encodings.

For example, these synthetic references identify the same semantic URI path but differ as raw strings:

https://lists.apache.org/thread.html/example%40%3Cdev.apache.org%3E
https://lists.apache.org/thread.html/example@%3Cdev.apache.org%3E
https://lists.apache.org/thread.html/example@<dev.apache.org>

Before this change, these values could be emitted as separate CycloneDX advisory entries.

The root cause is that advisory URLs were deduplicated before URI canonicalization. A simple url.Parse(raw).String() roundtrip is not sufficient here because Go may preserve RawPath, causing equivalent paths such as:

...%40%3Cdev.apache.org%3E
...@%3Cdev.apache.org%3E

to remain serialized differently.

This PR fixes the issue by canonicalizing advisory URLs before deduplication:

1. Parse the advisory URL.
2. Rebuild a new url.URL from decoded URL components.
3. Do not preserve RawPath.
4. Serialize the rebuilt URL with String().
5. Deduplicate the canonical serialized URLs.
6. Emit the canonical URLs in CycloneDX advisories.

The change is intentionally limited to CycloneDX advisory output. It does not change JSON report generation, vulnerability database records, upstream reference collection, SPDX output, or non-SBOM vulnerability reporting.

Before:

[
  {
    "url": "https://lists.apache.org/thread.html/example%40%3Cdev.apache.org%3E"
  },
  {
    "url": "https://lists.apache.org/thread.html/example@%3Cdev.apache.org%3E"
  },
  {
    "url": "https://lists.apache.org/thread.html/example@<dev.apache.org>"
  }
]

After:

[
  {
    "url": "https://lists.apache.org/thread.html/example@%3Cdev.apache.org%3E"
  }
]

The output no longer contains raw < or > characters in advisory URLs.

Tests added cover:

• equivalent advisory URLs with different path encodings
• duplicate advisory URLs across PrimaryURL and References
• canonical output without raw < or > characters
• preservation of distinct advisory URLs
• existing behavior for extracting the first URL token from strings with additional text

Test command:

GOEXPERIMENT=jsonv2 go test -vet=off ./pkg/sbom/cyclonedx/...

Result:

PASS

Note: without GOEXPERIMENT=jsonv2, this checkout fails to compile due to the repository's encoding/json/v2 dependency. The failure is unrelated to this change.

Related issues

N/A

Checklist

• I've read the [guidelines for contributing](https://trivy.dev/docs/latest/community/contribute/pr/) to this repository.
• I've followed the [conventions](https://trivy.dev/docs/latest/community/contribute/pr/#title) in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the [documentation](https://github.com/aquasecurity/trivy/blob/main/docs) with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}