feature: license detection by layer

[spiffcs]

Grant consumes syft as it's default SBOM generator when users don't bring their own bill of material.

Syft has an open issue which would enhance the scoping selections anchore/syft#15. Completing this issue would allow grant to then provide users the option to do analysis for different layers of an image.

This is useful for when users want to do analysis on the software they're adding while excluding packages from the base layer. If an organization or user has already done analysis against the base image than they might only be concerned with a cross section of the container for license compliance.