fix(publish-image): Shrink SBOM attestations to unblock NiFi builds

[dervoeti]

NiFi builds are continuously failing on the SPDX attest step, Rekor rejects the upload right after the CycloneDX attestation of the same image. I believe this is because, for NiFi, we publish two very large SBOMs shortly after another.

Since the SBOMs currently contain a quite some amount of unnecessary components we can reduce the SBOM size drastically to hopefully fix the problem. We wanted to do that anyway in order to improve the SBOM contents.

Two measures:

1. Disable syft file metadata cataloging (SYFT_FILE_METADATA_SELECTION):
   File-type components have no purl, are useless for vulnerability matching, and made up most of the component count on large images (for NiFi: 9211 of 13045). They were also dropped in the SPDX conversion anyway, so the two published formats disagreed about file inventory.

Example of a file-type component that is now no longer emitted:

  {
    "bom-ref": "4bd90840156a6978",
    "hashes": [
      { "alg": "SHA-1",   "content": "3e31ab9b1a70f6dbf441b2cb6fe9b6f6f8497c07" },
      { "alg": "SHA-256", "content": "e94e50735e137e769b40e230f019d5be755571129e0f7669c4570bb45c5c162e" }
    ],
    "name": "/etc/GREP_COLORS",
    "type": "file"
  }

2. Strip syft's per-component bookkeeping properties (layer IDs, evidence annotations, package IDs) after mergebom has consumed them, but keeping the found-at paths and the cataloger name (these are useful for debugging). We need to use jq as syft has no option to suppress these properties.

Example:
Before:

      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "java-archive-cataloger"
        },
        {
          "name": "syft:package:language",
          "value": "java"
        },
        {
          "name": "syft:package:type",
          "value": "java-archive"
        },
        {
          "name": "syft:package:metadataType",
          "value": "java-archive"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "sha256:0a74089b4ff722cb08ca668c33169d5c4433c2cc1047a7d3f4554944b59e6c78"
        },
        {
          "name": "syft:location:0:path",
          "value": "/stackable/nifi-2.9.0-stackable0.0.0-dev/lib/nifi-iceberg-shared-nar-2.9.0-stackable0.0.0-dev.nar"
        },
        {
          "name": "syft:metadata:virtualPath",
          "value": "/stackable/nifi-2.9.0-stackable0.0.0-dev/lib/nifi-iceberg-shared-nar-2.9.0-stackable0.0.0-dev.nar:META-INF/bundled-dependencies/RoaringBitmap-1.3.0.jar"
        }
      ]

After:

      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "java-archive-cataloger"
        },
        {
          "name": "syft:location:0:path",
          "value": "/stackable/nifi-2.9.0-stackable0.0.0-dev/lib/nifi-iceberg-shared-nar-2.9.0-stackable0.0.0-dev.nar"
        },
        {
          "name": "syft:metadata:virtualPath",
          "value": "/stackable/nifi-2.9.0-stackable0.0.0-dev/lib/nifi-iceberg-shared-nar-2.9.0-stackable0.0.0-dev.nar:META-INF/bundled-dependencies/RoaringBitmap-1.3.0.jar"
        }
      ]