fix: preserve monitor identity for poetry.lock

[thomasschafer]

This PR adds a small fix to Identity.TargetFile to ensure it matches the logic in Registry. Currently, depGraphOutputToSCAResult forwards the legacy CLI's targetFileFromPlugin field into Identity.TargetFile, and that value flows downstream into the monitor project identity. If it ever diverges from what the legacy CLI itself sends, existing monitor projects are not found and duplicates get created.

Registry applies one compatibility transform on input: exact-string "poetry.lock" → "pyproject.toml". snyk-python-plugin already produces "pyproject.toml", so the transform is unused today, but if that invariant ever breaks (e.g. changes to the Poetry resolver) we would no longer be matching the behaviour in Registry.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Compilation Error (2 occurrences) 🔴 [critical] pkg/ecosystems/legacy/plugin.go The function mapToTargetFileIdentity uses new("pyproject.toml"). In Go, the built-in new function takes a Type as its argument (e.g., new(string)), not a value. This will result in a compilation error: 'pyproject.toml' is not a type. To return a pointer to a string literal, you must either use a helper function (like the stringPtr function that was removed in this PR) or assign the value to a variable and take its address. pkg/ecosystems/legacy/plugin_test.go The test cases in TestPlugin_TargetFileForwarding have been updated to use new("project.assets.json") and similar patterns. This will cause a compilation error as new expects a type, not a constant value. The previous implementation used a local helper stringPtr, which is the standard way to handle this in Go tests.

📚 Repository Context Analyzed This review considered 6 relevant code sections from 6 files (average relevance: 1.00) pkg/depgraph/sbom_resolution.go (lines 1-231) internal/legacycli/legacy_resolution.go (lines 1-113) pkg/ecosystems/python/pip/plugin.go (lines 1-251) pkg/ecosystems/orchestrator/registry.go (lines 1-192) pkg/ecosystems/README.md (lines 214-358) pkg/ecosystems/legacy/plugin.go (lines 1-174)