Use SHA256 digest versioning for docker/chainguard SBOMs

[vpetersson]

Summary

• Docker/chainguard sources now use the image SHA256 digest as COMPONENT_VERSION instead of the mutable tag, fixing false dedup and enabling content traceability
• New sbomify API dedup: before upload, checks if the release already has an artifact with the same digest; after upload, cleans up stale artifacts for the same component
• github_release/lockfile sources unchanged — still use semver with TEA dedup

Changes

File	Description
scripts/sources/docker-attestation.sh	Write image_digest to image-digest.txt
scripts/sources/chainguard.sh	Resolve digest via crane digest, write to image-digest.txt
scripts/lib/sbomify-api.sh	New — sbomify_digest_exists and sbomify_cleanup_old_artifacts
.github/workflows/sbom-builder.yml	Digest read step, sbomify dedup check, unified upload decision, digest-based version, artifact cleanup

Test plan

• Dry-run PR CI validates all apps pass (no API calls in dry-run)
• Manual dispatch for one docker app (e.g. alpine): verify digest read, dedup check, upload with digest version, old artifact cleanup
• Re-run same app: verify dedup detects existing digest and skips upload
• Run a github_release/lockfile app: verify TEA dedup path still works unchanged

🤖 Generated with Claude Code