extractor/os/rpm: add Mageia ecosystem mapping

[herdiyana256]

Closes #2177

Problem

Currently, when OSV-SCALIBR extracts RPM packages from a Mageia distribution, the *rpmmeta.Metadata switch in extractor/filesystem/os/ecosystem/ecosystem.go does not recognize the mageia OSID. As a result, it falls through to the default behavior and returns an empty ecosystem namespace.

This prevents OSV-SCALIBR from matching any extracted packages against the 5,941+ official Mageia security advisories tracked on OSV.dev. None of these advisories are reachable today because the ecosystem is never correctly set.

Examples of critical but undetected advisories due to this missing mapping:

• MGASA-2021-0526 - log4j — Log4Shell RCE (CVSS 10.0, Critical)
• MGASA-2023-0298 - curl — SOCKS5 heap overflow (CVSS 9.8, Critical)
• MGASA-2022-0450 - openssl — CVE-2022-3602/3786 (Critical)
• MGASA-2022-0049 - polkit — CVE-2021-4034 (CVSS 7.8)
• MGASA-2023-0109 - sudo — CVE-2023-22809 (CVSS 7.8)

Solution

This PR adds support for mapping Mageia RPM packages to the correct OSV.dev ecosystem:

• Adds a check for m.OSID == "mageia" in ecosystem.go which explicitly returns osvconstants.EcosystemMageia.
• Uses m.OSVersionID as the suffix to capture the major version correctly (e.g. Mageia:9), matching the taxonomy of OSV.dev advisories.
• Adds comprehensive unit test cases (Mageia_9, Mageia_8, and Mageia_no_version) in ecosystem_test.go to validate parsing.
• Updates the official plugin documentation (docs/supported_inventory_types.md) to reflect that the RPM extractor now supports Mageia.

Note: E2E tests for the Mageia ecosystem will follow as a separate PR in the osv-scanner repository (similar to the AlmaLinux follow-up pattern in google/osv-scanner#2870).

Before / After

Before:
pkg:rpm//openssl@3.0.8-1.mga9 ← namespace empty, zero MGASA matches

After:
pkg:rpm/mageia/openssl@3.0.8-1.mga9 (ecosystem: Mageia:9)

Verification

$ go test ./extractor/filesystem/os/ecosystem/... -v -run TestEcosystemRPM
=== RUN   TestEcosystemRPM
=== RUN   TestEcosystemRPM/Mageia_9
=== RUN   TestEcosystemRPM/Mageia_8
=== RUN   TestEcosystemRPM/Mageia_no_version
--- PASS: TestEcosystemRPM (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_9 (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_8 (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_no_version (0.00s)
PASS
ok  	github.com/google/osv-scalibr/extractor/filesystem/os/ecosystem	0.007s

$ go test ./extractor/filesystem/os/ecosystem/...
PASS

$ go test ./extractor/filesystem/os/rpm/...
PASS

$ go vet ./extractor/filesystem/os/ecosystem/...

[herdiyana256]

PR submitted: #2199

[herdiyana256]

Hi @michaelkedar, this PR implements the Mageia RPM ecosystem mapping for the accepted PRP #2177, same one-branch pattern as the merged AlmaLinux mapping in #2148. All checks pass. The E2E follow-up in osv-scanner#2873 depends on this landing first, since the scanner needs the Mageia to Mageia:9 mapping before it can surface MGASA advisories. Would appreciate a review when you have a moment. Thanks!

[herdiyana256]

@jess-lowe all checks green, approved, just blocked on protected branch merge. mind merging when you get a sec?

[herdiyana256]

@michaelkedar PR is approved by @jess-lowe and all 14 checks are green.
Blocked only on protected branch merge permissions.

Could you merge when you get a chance? Thanks! :)