Reconsider dependency on archived fork https://github.com/anchore/go-version

Hi! I'm working on Debian Go packaging, and we currently ship https://github.com/anchore/go-version but noticed the project has been archived. It would be nice if syft was updated to not depend on an archive/unmaintained project like that. Thanks!