Surface SBOMs from /var/lib/db/sbom

[jdolitsky]

After building the image filesystem, scan the /var/lib/db/sbom directory looking for files in the form:

• $package.cdx (CycloneDX)
• $package.spdx.json (SPDX)

These files should be included during a melange build of APK with name $package.

The package data from these should be included in the final SBOM(s), noting the APK which it derives from.

[amouat]

Upped this to P1 as I think it would give us a strong sell in demos if our SBOMs are bomb. For the moment at least it will be a USP.

[luhring]

Closed by https://github.com/chainguard-dev/apko/pull/309 (thanks @puerco!)