EC2 root volumes are not inventoried for packages #102

Problem

om scan aws records an EC2 instance from DescribeInstances: instance type, public IP, IMDSv2, platform, and the AMI id as image. It does not read the root volume. A Java library installed on the instance never appears in packages, so om enrich cve cannot attach the CVE.

Phase 4 starts here. The phase ends when a package in persistent workload storage is a CVE finding on the workload the graph already stores. This issue is the AWS Linux root volume, the first of those stores.

Done when

• An opt-in command, separate from om scan aws, inventories Linux root volumes. om scan aws stays a read-only API scan.
• A worker in the customer account and region creates a snapshot, attaches it read-only, and deletes the snapshot and any volume it created, including when the scan fails.
• The scan writes CPE 2.3 names and versioned package URLs onto packages of the existing workload node. om enrich cve is unchanged and attaches a CVE only when those identifiers match.
• The graph, logs, and exports store package identifiers. They do not store file contents.
• The command's permission list includes snapshot create, volume attach, snapshot delete, and the KMS decrypt grant an encrypted volume needs.
• Windows, LVM, and non-root data volumes are out of this issue. Azure, GCE, boot images, container layers, function bundles, and shared filesystems are later Phase 4 issues.

An existing SBOM tool may produce the identifiers. The graph contract is the packages property enrichment already parses.

Design can land in this issue before code.