Fix Debian point release detection

[OsamaSE]

Description

Debian stable keeps /etc/os-release VERSION_ID at the major release, while /etc/debian_version carries the point release. Syft already reads /etc/debian_version when os-release has no Debian version (#4569); this also uses it when os-release only has the major version.

Debian documents this split in base-files: VERSION_ID="13" and DEBIAN_VERSION_FULL=13.5. The Debian discussion for adding point releases to VERSION_ID instead concluded that VERSION_ID should continue to identify the release series, with full point-release information exposed in a separate Debian-specific field.

• Debian discussion confirming VERSION_ID should identify the release series: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931197#49
• Debian base-files example showing VERSION_ID="13" and DEBIAN_VERSION_FULL=13.5: https://sources.debian.org/src/base-files/13.8%2Bdeb13u5/etc/os-release/

This also aligns Debian with other distro metadata where VERSION_ID commonly includes minor or patch versions, for example Ubuntu 24.04, Rocky 9.3, and Alpine 3.21.7.

On a Debian point-release image, Trivy did not report the same findings from a Syft-generated SBOM when the SBOM identified the distro as only the major release (13). The SBOM scan matched Trivy's direct image scan when the SBOM used the point release (13.5), which is expected because Trivy puts Debian OS versions into the package PURL distro qualifier and requires qualifier values to match.

• Trivy PURL matching requires qualifier values to match: https://github.com/aquasecurity/trivy/blob/main/pkg/purl/purl.go#L265-L290

This is not expected to change Grype or Dependency-Track vulnerability results, since both treat Debian point releases as matching the major series:

• Grype accepts distro namespace versions as partial prefixes, so 13 matches 13.5: https://github.com/anchore/grype/blob/main/grype/search/distro.go#L93-L104
• Dependency-Track treats debian-11.6 as matching debian-11: https://github.com/DependencyTrack/dependency-track/blob/main/vuln-analysis/internal/src/test/java/org/dependencytrack/vulnanalysis/internal/InternalVulnAnalyzerTest.java#L572-L573

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Related: #4569