Azure VM and GCE root volumes are not inventoried for packages #103

Problem

om scan azure and om scan gcp record the virtual machine from the cloud API. They do not read the OS disk. Packages installed on an Azure VM or a GCE instance never reach packages, so om enrich cve cannot match them.

This follows the AWS Linux root-volume scan. The filesystem walk is the same. The snapshot and attach APIs are not.

Done when

• The opt-in workload scan covers Azure VM OS disks and GCE boot disks, using a worker in the customer subscription or project and in the same region.
• Each scan creates a snapshot, reads it read-only, and deletes the snapshot and any disk it created, including on failure.
• CPE 2.3 names and versioned package URLs are written to packages on the existing workload. om enrich cve attaches a CVE only when those identifiers match.
• Package identifiers are the only bytes copied off the disk.
• The Azure and GCP permission lists name the snapshot, disk-attach, delete, and encryption-unwrap calls this scan adds. om scan azure and om scan gcp stay read-only.
• Windows and data disks are out of this issue.

Depends on the AWS root-volume scan having defined the packages contract and the worker lifecycle.

Design can land in this issue before code.