Closes #3398.

What

The Go matcher silently drops advisories pinned at an import path inside a larger module. Go binaries only retain module-granularity build info via `debug/buildinfo`, so syft emits the module (`golang.org/x/crypto`) but the advisory's package name (`golang.org/x/crypto/ssh`) is what GitHub Advisories / OSV record. The matcher's case-insensitive exact-name lookup never lands.

The issue calls out GHSA-mh2q-q3fh-2475 / CVE-2026-29181 as a recent example: pinned at `go.opentelemetry.io/otel/baggage` and `/propagation`, missed by grype against binaries linking `go.opentelemetry.io/otel` v1.40.0 until the advisory was manually amended to also list the parent module. Every future advisory filed at import-path granularity hits the same wall.

Fix

The Go matcher now supplements the existing exact-name lookup with a prefix-search keyed on the SBOM package name plus a `/` segment break. So when the SBOM has `golang.org/x/crypto`, advisories pinned at `golang.org/x/crypto/ssh` (or any deeper sub-path) surface alongside ones pinned at the module name itself.

Path-segment safety: the prefix is `p.Name + "/"`, not just `p.Name`. `golang.org/x/crypto` matches `golang.org/x/crypto/ssh` but does NOT match `golang.org/x/cryptographer`. The `/` is enforced in two places: the SQL `LIKE` pattern, and the criterion's `MatchesVulnerability` (defense-in-depth). LIKE wildcards in the prefix are neutralized via SQLite `ESCAPE` clause.

The prefix path runs only when:

• the package type is `syftPkg.GoModulePkg`, and
• the name contains at least one `/`.

Both conditions together prevent the synthetic `stdlib` entry or other single-segment names from fanning out across the entire Go advisory corpus.

The trade-off (over-reporting when a binary doesn't import a vulnerable sub-package of a module it depends on) is called out in the issue and is the desired direction for a vulnerability scanner; downstream reachability triage belongs to tools like govulncheck.

Implementation notes

• New `search.ByPackageNamePrefix` criterion. `MatchesVulnerability` enforces the `prefix + "/"` boundary case-insensitively.
• `PackageSpecifier` gains a `NamePrefix` field; the v6 store translates it into `packages.name LIKE ? ESCAPE '\\' collate nocase`. The escape clause + replacer handle `%`, `_`, and `\\` in user-supplied prefixes safely.
• Search query builder dispatches on the new criterion type.
• A shared internal helper (`matchPackageByEcosystem`) factors out the disclosure / unaffected / version / qualified-package pipeline so the prefix path reuses it unchanged. Prefix-matched advisories participate in version filtering and ignore-rule construction the same way exact-matched ones do — including unaffected naks.
• CPEs are not re-queried under the prefix path; the exact-name path above already covered them for `p.Name`.

Test plan

• `Test_ByPackageNamePrefix` covers the criterion: matches under boundary, deep sub-paths, case-insensitive, sibling-substring-without-segment-break does not match, exact name does not match, empty prefix returns false.
• `TestMatcher_ImportPathGranularityAdvisories` exercises the matcher end-to-end via the mock vulnerability provider:
  • `golang.org/x/crypto` SBOM surfaces both an exact `golang.org/x/crypto` advisory AND an import-path `golang.org/x/crypto/ssh` advisory, while a sibling `golang.org/x/cryptographer` advisory does NOT match (boundary trap).
  • `go.opentelemetry.io/otel` SBOM surfaces sibling import-path advisories under it (the original issue's example).
  • SBOM directly matching an import-path advisory still hits via the exact path (no regression).
  • Single-segment package name (`stdlib`) does NOT fan out to the corpus.
  • Non-Go package types are unaffected.
• `TestNewSearchCriteria` gains a case for the new prefix criterion / specifier wiring.
• Existing `grype/matcher/golang` and `grype/matcher/internal` tests continue to pass.
• `go build ./...`, `go vet ./grype/...` (no new warnings), `task lint` (`golangci-lint` clean), `task format` (gofmt + gosimports + go mod tidy clean).
• Full `go test ./grype/matcher/... ./grype/search/... ./grype/db/v6/...` suite green.