Context
Today we capture only package-to-package relationships. It isn't possible to express things such as a file-to-package or file-to-file relationship.

The goals of this issue are:

1. Promote relationships as a first class artifact objects raised by catalogers.
2. Enable describing relationships for things other than packages (such as files)

To goal 1: catalogers today only raise []pkg.Package, which means that any relationships you are adding must be added after the cataloging step, after connectivity data may be missing (this is the case for most ecosystems). If the cataloger were to additionally return []Relationship it would allow the catalogers to be more expressive.

To goal 2: Today's pkg.Relationship should probably be promoted to a root-level package. This additionally implies that the existing pkg.ID will need to be replaced with something more agnostic... with additional requirements that anything that wants to express a relationship with something else have an ID that works globally.

This work is most likely coupled to how IDs are expressed in packages; that is, should they remain as UUIDs? or something more stable like a package fingerprint? See #363 for more details.