What would you like to be added:

ELF note cataloger picks up the package name, and package type, but not the OS distro vendor

Why is this needed:

Without picking up OS distro vendor, there is not automatic matching to the vendor remediation feeds to provide "Fixed In" values when scanning syft json with grype

Additional context:

In Wolfi, I have this elf note:

# readelf --notes ./lib/python3.13/site-packages/cryptography.libs/libcrypto-b943a01c.so.3 
Displaying notes found in: .note.package
  Owner                Data size 	Description
  FDO                  0x0000005c	FDO_PACKAGING_METADATA
    Packaging Metadata: {"type":"apk","os":"wolfi","name":"openssl","version":"3.6.0-r0","architecture":"x86_64"}

The current syft PURL generated for this apk is:

pkg:apk/openssl@3.6.0-r0

But ideally it should be

pkg:apk/wolfi/openssl@3.6.0-r0

Or well whatever the "os" field is, ditto for example for Fedora, CentOS, RHEL, AmazonLinux 2023 all of which have similar ELF build notes too.