fix(sbom): Bump in-toto-golang with correct CycloneDX predicate

[L1ghtman2k]

Description

Bump in-toto-golang lib, with the correct CycloneDX.

Currently, the used value is: https://cyclonedx.org/schema, however, it should be https://cyclonedx.org/bom.

This would also make trivy compatible with tools like cosign, and would allow trivy to scan SBOMs with a correct predicate: sigstore/cosign#2368

This introduces potentially breaking changes, as attestations with the previous cyclonedx predicate(https://cyclonedx.org/schema) would no longer be scannable by trivy sbom /path/to/report.cdx.intoto.jsonl command

Related PRs

• CycloneDX predicate is wrong in-toto/in-toto-golang#187
• Bump in-toto-golang dependency to fix incompatibility issue sigstore/cosign#2368

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[L1ghtman2k]

(Had to recreate the PR, because for some reason my old PR shows big diff)

[knqyf263]

Thanks!