Boot images are not inventoried for packages #104

Problem

Many instances boot from one image: an AMI, an Azure image, or a GCE image. The image is a snapshot of a root volume, and it is where the golden software lives. Scanning only running instances repeats that work per instance and misses an image that is not currently booted.

Done when

• The opt-in workload scan reads a boot image once, through the same package walker as a root volume, and deletes any snapshot or disk it created.
• Instances launched from that image carry the image's package identifiers on their workload nodes.
• A package that exists only on an instance's own disk, added after boot, is attributed to that instance and not to the image.
• The graph stores CPE 2.3 names and versioned package URLs. om enrich cve matches them as it does any other packages list.

Depends on the root-volume scan. Marketplace images the account is not allowed to snapshot stay unscanned, and the scan says so.

Design can land in this issue before code.