SBOMs seem to miss file entry for files in /

[imjasonh]

https://apk.dag.dev/https/packages.wolfi.dev/os/x86_64/crossplane-provider-aws-cloudwatchlogs-0.47.1-r2.apk@sha1:dbbf0ec484e449afc23733180540116f6446db88/ has package.yaml in the root of the FS

The SBOM in the package mentions that file as being owned by the package, but doesn't have a file entry for that file.

https://apk.dag.dev/https/packages.wolfi.dev/os/x86_64/crossplane-provider-aws-cloudwatchlogs-0.47.1-r2.apk@sha1:dbbf0ec484e449afc23733180540116f6446db88/var/lib/db/sbom/crossplane-provider-aws-cloudwatchlogs-0.47.1-r2.spdx.json

grep -A10 -B10 package.yaml /var/folders/gw/86t1jg2109s5j8vzszj281kc0000gn/T/tmp.iEfWbqMrhx/sbom.json
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:apk/wolfi/crossplane-provider-aws-firehose@0.47.1-r2?arch=x86_64",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": true,
      "hasFiles": [
        "SPDXRef-File--package.yaml"
      ],
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "Apache-2.0",
      "name": "crossplane-provider-aws-firehose",
      "originator": "Organization: Wolfi",
      "packageVerificationCode": {
        "packageVerificationCodeValue": "fd6317a337997a8a066a61c1b9f6a4f74a1d9fd1"
      },
      "versionInfo": "0.47.1-r2"
    },
--
      "relatedSpdxElement": "SPDXRef-File--etc-secfixes.d-chainguard",
      "relationshipType": "CONTAINS",
      "spdxElementId": "SPDXRef-Package-chainguard-baselayout-20230214-r6"
    },
    {
      "relatedSpdxElement": "SPDXRef-Package-crossplane-provider-aws-firehose-0.47.1-r2",
      "relationshipType": "CONTAINS",
      "spdxElementId": "SPDXRef-Package-sha256-5ef519fe59ce4076c9013da3489e05fb782c033dcb121ee1f818c798839a8098"
    },
    {
      "relatedSpdxElement": "SPDXRef-File--package.yaml",
      "relationshipType": "CONTAINS",
      "spdxElementId": "SPDXRef-Package-crossplane-provider-aws-firehose-0.47.1-r2"
    },
    {
      "relatedSpdxElement": "SPDXRef-Package-terraform-1.5.7-r3",
      "relationshipType": "CONTAINS",
      "spdxElementId": "SPDXRef-Package-sha256-5ef519fe59ce4076c9013da3489e05fb782c033dcb121ee1f818c798839a8098"
    },
    {
      "relatedSpdxElement": "SPDXRef-File--usr-bin-terraform",