feat(python): add pylock.toml (PEP 751) parser

[sneaky-potato]

Description

This PR adds a parser for pylock.toml file, check this

Related issues

• Close Add support for pylock.toml (PEP 751) #9410

Related PRs

Plan to create one more PR for pylock.toml analyzer

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Copilot]

Pull Request Overview

This PR implements a parser for pylock.toml files according to PEP 751, extending Trivy's Python dependency parsing capabilities to support this new lock file format.

• Adds pylock.toml parser with TOML-based structure handling
• Includes test data file with realistic package dependencies and wheel information
• Integrates the new parser into Trivy's Python dependency parsing framework

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/fanal/types/const.go	Adds PyLock constant for "pylock.toml" file identification
pkg/dependency/parser/python/pylock/parse.go	Core parser implementation with TOML structures and parsing logic
pkg/dependency/parser/python/pylock/parse_test.go	Unit tests validating parser functionality with expected package outputs
pkg/dependency/parser/python/pylock/testdata/pylock.toml	Test data file containing sample pylock.toml structure with packages and wheels

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[knqyf263]

Can we also analyze dependency relationships?

[sneaky-potato]

Updated the parser to get dependencies as well
However I have one query, I tried setting up a pylock.toml using pip, uv and poetry and in all cases, the pylock.toml had no dependencies. Does the format follow a flat dependency structure always?

[knqyf263]

I tried setting up a pylock.toml using pip, uv and poetry and in all cases, the pylock.toml had no dependencies.

Do you mean this field is always empty?
https://peps.python.org/pep-0751/#packages-dependencies

[sneaky-potato]

The specification does not mention that it will be always empty, so I have added the code for parsing dependencies. Please review the change.

However I was able to find the following issue from uv here. Looks like uv has not implemented the dependencies field yet.

[knqyf263]

@sneaky-potato Could you fix the lint issues? mage lint:run or mage lint:fix helps.