Currently when a file exists in a layer it is assumed it is present in the final container, this is not true if the file has a matching whiteout file in higher layers.

We need to ensure we only show vulns for packages that are still present in the final image (ie account for .wh. and .wh..wh..opq files and ensure those files in lower layers are ignored).