feat(publish-image): Attest SPDX SBOM alongside CycloneDX

[dervoeti]

We currently only generate and attest CycloneDX SBOMs, but some consumers expect SPDX. This PR derives an SPDX SBOM from the existing merged CycloneDX SBOM and attests it to the image as a second predicate, so every image we publish carries both formats.

Rather than generating SPDX independently, the merged CycloneDX SBOM is converted with syft convert. This keeps both formats describing the same merged, deduplicated inventory (the mergebom output, including the reconstructed JAR dependency graph and the rhel -> redhat rename).
Known issue: File-level entries are dropped by the conversion, package and dependency information is preserved. That is fine as the file-level information is totally optional anyway, SPDX still includes all the necessary information.

One extra step was needed: syft still emits the deprecated SPDX license id GPL-2.0-with-classpath-exception, which strict SPDX validators reject. We rewrite it to the valid GPL-2.0-only WITH Classpath-exception-2.0 expression with jq. With that, the converted SPDX validates cleanly (pyspdxtools exits 0, while without it, exit 1 with 33+ errors).

[NickLarsenNZ]

LGTM

[dervoeti]

Release note

SPDX SBOMs: In addition to the existing CycloneDX SBOMs, every image now also has an SBOM in the SPDX format attested to it. See the SBOM guide in our documentation for how to verify and extract them.