feat(extractor): Add Hugging Face Transformers config.json extractor

[SteppL10n-prog]

Summary

This PR adds a new filesystem extractor for Hugging Face Transformers AI models that:

• Detects config.json and adapter_config.json files in model directories
• Extracts transformers_version field from JSON config
• Generates standard PURL: pkg:pypi/transformers@<version>
• Enables vulnerability matching via OSV.dev, GHSA, and NVD

Why This Matters

• 500K+ public AI models on Hugging Face Hub
• Many models depend on transformers library with known CVEs
• No existing extractor scans AI model configs for vulnerable dependencies
• This PR fills that gap with minimal, performant code

Category Compliance

This is a software inventory extractor, NOT a secret/vulnerability detector.

• Extracts dependency metadata from config files
• Generates standard PURL identifiers for OSV matching
• Aligns with PRP scope narrowing (PRP scope narrowing - Inventory extraction #1949)

Testing

• 24 test cases covering success, error, and edge scenarios
• 100% statement coverage
• Docker-verifiable via Dockerfile.test

Files Added

• extractor/filesystem/ai/huggingface-transformers/extractor.go
• extractor/filesystem/ai/huggingface-transformers/extractor_test.go

Related Issues

• Related: [RFC] PRP: Extractor for Hugging Face Transformers model configs (config.json) #1988 (RFC feedback)
• Related: PRP scope narrowing - Inventory extraction #1949 (PRP scope narrowing)

Signed-off-by: Mahmut Boz mahmutbozl10n@gmail.com

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.