fix: add empty default for versionInfo

We need this because running syft against a host directory with the
output format `spdx-json` adds one informational entry to the package
array, which does not contain a versionInfo field and can simply be
ignored

src/metrics.rs

@@ -35,6 +35,7 @@ pub fn export_metrics(
         let sbom: Sbom = serde_json::from_value(sbom)?;
         for entry in sbom.packages {
             let source = source.clone().into();
+            if entry.versionInfo.is_empty() { continue };
             syft_metrics
                 .get_or_create(&SbomLabels {
                     software: entry.name,

src/sbom.rs

@@ -18,6 +18,7 @@ use crate::config::{Config, Source};
 #[derive(Clone, Debug, Hash, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct SbomEntry {
     pub name: String,
+    #[serde(default)]
     pub versionInfo: String,
 }