fix: match OpenSSL letter releases

[harmw]

This should resolve #2681

Original results using syft:v0.105.1:

 ✔ Loaded image                                                                          openresty/openresty:1.25.3.1-2-alpine
 ✔ Parsed image                                        sha256:b1cb45b1556801b8cb1bc29ea78faf2eaf67926a37b052dd070866e44d7df07a
 ✔ Cataloged contents                                         db4ad5d00580ca709b0423af26df39b23d48a1b792fea8ede029a1e412776470
   ├── ✔ Packages                        [52 packages]
   ├── ✔ File digests                    [403 files]
   ├── ✔ File metadata                   [403 locations]
   └── ✔ Executables                     [125 executables]

Scan:

 ✔ Vulnerability DB                [no update available]
 ✔ Scanned for vulnerabilities     [54 vulnerability matches]
   ├── by severity: 3 critical, 13 high, 36 medium, 2 low, 0 negligible
   └── by status:   4 fixed, 50 not-fixed, 0 ignored

Create SBOM using syft from this branch:

export DOCKER_HOST="unix://${HOME}/.colima/default/docker.sock"

./dist/darwin-build_darwin_arm64/syft packages docker:openresty/openresty:1.25.3.1-2-alpine -o spdx-json --file 2681.spdx.json
Command "packages" is deprecated, use `syft scan` instead
Flag --file has been deprecated, use: output
 ✔ Loaded image                                                                          openresty/openresty:1.25.3.1-2-alpine
 ✔ Parsed image                                        sha256:b1cb45b1556801b8cb1bc29ea78faf2eaf67926a37b052dd070866e44d7df07a
 ✔ Cataloged contents                                         db4ad5d00580ca709b0423af26df39b23d48a1b792fea8ede029a1e412776470
   ├── ✔ Packages                        [52 packages]
   ├── ✔ File digests                    [403 files]
   ├── ✔ File metadata                   [403 locations]
   └── ✔ Executables                     [125 executables]

Scan again:

 % docker run --rm -it -v ${PWD}:/work -v ~/.grype/cache:/.cache/grype anchore/grype:v0.74.4 sbom:/work/2681.spdx.json -o sarif --file /work/scan.sarif
 ✔ Vulnerability DB                [no update available]
 ✔ Scanned for vulnerabilities     [24 vulnerability matches]
   ├── by severity: 0 critical, 4 high, 20 medium, 0 low, 0 negligible
   └── by status:   4 fixed, 20 not-fixed, 0 ignored