missing provided files for dpkg packages

[ArmanPasha]

What happened:
Syft missed a file provided by libcurl4 package in a Debian-based image. Below is the list of files provided by the libcurl4 package:

> cat /var/lib/dpkg/info/libcurl4\:amd64.list
/.
/usr
/usr/lib
/usr/lib/x86_64-linux-gnu
/usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0
/usr/share
/usr/share/doc
/usr/share/doc/libcurl4
/usr/share/doc/libcurl4/changelog.Debian.gz
/usr/share/doc/libcurl4/changelog.gz
/usr/share/doc/libcurl4/copyright
/usr/lib/x86_64-linux-gnu/libcurl.so.4

Below is the Syft output showing the provided files by libcurl4:

"files": [
            {
                "path": "/usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0",
                "digest": {
                    "algorithm": "md5",
                    "value": "f77ab96de521fd73904cd6fd5d8e7d93"
                },
                "isConfigFile": false
            },
            {
                "path": "/usr/share/doc/libcurl4/changelog.Debian.gz",
                "digest": {
                    "algorithm": "md5",
                    "value": "9cc1117e3db648eca660c608b7d08cc3"
                },
                "isConfigFile": false
            },
            {
                "path": "/usr/share/doc/libcurl4/changelog.gz",
                "digest": {
                    "algorithm": "md5",
                    "value": "0a7d15f1f7beb98774b69a1e88bc2119"
                },
                "isConfigFile": false
            },
            {
                "path": "/usr/share/doc/libcurl4/copyright",
                "digest": {
                    "algorithm": "md5",
                    "value": "f9f6598312858fead4eed4d151197550"
                },
                "isConfigFile": false
            }
]

The issue is that /usr/lib/x86_64-linux-gnu/libcurl.so.4 file is missing from the Syft output. I haven't looked at the code but I guess the issue is in the logic that combines file paths to remove incomplete paths like /usr, /usr/lib, /usr/lib/x86_64-linux-gnu. The logic somehow treats /usr/lib/x86_64-linux-gnu/libcurl.so.4 as a prefix of /usr/lib/x86_64-linux-gnu/libcurl.so.4.8.0 hence removing the former from the provided files.

What you expected to happen:
Include /usr/lib/x86_64-linux-gnu/libcurl.so.4 in the provided files output.

Steps to reproduce the issue:
Use this Dockerfile:

FROM debian:stable-slim

RUN apt update
RUN apt install -y libcurl4

CMD ["cat", "/var/lib/dpkg/info/libcurl4:amd64.list"]

Anything else we need to know?:

Environment:

• Output of syft version: 1.17.0
• OS (e.g: cat /etc/os-release or similar): container image is Debian GNU/Linux 12 (bookworm), host (where Syft runs) is Ubuntu 22.04.3 LTS