feat(sbom): Expose sbom main component to attestations

[javirln]

This patch make changes so when adding a SBOM_CYCLONEDX_JSON material type the CLI extracts the main component the sbom is related to and exposes it at the attestation level by using an annotation.

If the sbom being inspected is related to a OCI image, it standardizes the repository name and if not, just adds the main component name as it is.

Example of attestation:

"materials": [
         {
            "annotations": {
               "chainloop.material.cas.inline": true,
               "chainloop.material.name": "material-1734016181713664000",
               "chainloop.material.sbom.main_component.name": "index.docker.io/bitnami/wordpress",
               "chainloop.material.sbom.main_component.type": "container",
               "chainloop.material.sbom.main_component.version": "6.7.1-debian-12-r5",
               "chainloop.material.type": "SBOM_CYCLONEDX_JSON"
            },
            "digest": {
               "sha256": "25025ad29584ea25ccdedb4fbed2e2eabfb2398f4e1773819451c5a39d0f8cb1"
            },
            "name": "o.json"
         }
      ],

As we can see, we have detected the above sbom is related to a OCI image, bitnami/wordpress.

Close #1311

[migmartri]

thanks