Add SBOM command

[willdollman]

Add new src sbom command to allow customers to fetch and verify SBOMs.

This command will fetch SBOMs from our container registry, and validate them against a published public key.

To test this out locally:

$ go run ./cmd/src sbom fetch -v 5.8.287 --internal --insecure-ignore-tlog

Fetching SBOMs and validating signatures for all 55 images in the Sourcegraph 5.8.287 release...

⚠️ WARNING: Transparency log verification is disabled, increasing the risk that SBOMs may have been tampered with.
This setting should only be used for testing or under explicit instruction from Sourcegraph.

✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/appliance
✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/batcheshelper
✅ us-central1-docker.pkg.dev/sourcegraph-ci/rfc795-internal/bundled-executor
[...]

This will be followed by customer-facing docs around using this command.

Test plan

• Relying on CI
• Manual testing. This command is very reliant on external services, so building full testing seems disproportionate to the complexity.

[camdencheek]

LGTM! Left a fairly cursory review, let me know if you were looking for anything more in depth.

[camdencheek]

Nice touch!