fix(binary): correct traefik version detection on big-endian arches

[mayanksekhar]

Description

Fixes #4980 (partially covers the s390x false-positive; arm/v6 was also broken but the root cause and fix are the same).

The traefik-binary classifier regex required a NUL byte or replacement character immediately before the version string. On some architectures (e.g. s390x), the real version string in the binary has no such prefix, so the classifier instead matched an earlier, unrelated NUL-prefixed numeric string elsewhere in the binary (e.g. '2.7.0' from an unrelated printf-style format constant), producing an incorrect version.

This adds an additional pattern, tried first via MatchAny, that matches version strings terminated by two NUL bytes without requiring a NUL prefix. The original pattern remains as a fallback for older traefik binaries (e.g. v1.x) that use single-NUL termination.

The bug

The traefik-binary classifier's regex required a NUL byte or Unicode replacement character immediately before the version string. On some architectures (observed on s390x), the real version string has no such prefix, so the classifier instead matched an earlier, unrelated NUL-prefixed numeric string elsewhere in the binary (e.g.2.7.0 from an unrelated printf style format constant) producing a wrong, stale version regardless of the actual traefik version.

The fix

Added a second pattern, tried first via MatchAny, that matches version strings terminated by two NUL bytes without requiring any prefix. MatchAny stops at the first matcher that finds anything, so this new pattern takes precedence when it applies, while the original single-NUL pattern remains as a fallback for older traefik binaries (v1.x) that use single-NUL termination.

Verification

• Extracted real traefik:3.6.8 (s390x) and traefik:v2.11.1 (arm/v6) binaries from the images referenced in the original issue and confirmed the previous regex mismatched on s390x while the new one correctly resolves both.
• Added two new snippet-based test cases covering both architectures.
• Full traefik test subset passes (7/7), including the pre-existing v1.7.34/2.9.6/2.10.7/3.0.4/3.6.5 cases confirming no regression.
• Two unrelated pre-existing julia test failures were confirmed to exist identically on a clean main checkout (unrelated to this change).

Type of change

Fix Merge

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

#4980