Upload SBOM to a useful location

If a scan is run on an image in a registry, for example, it might be useful to [sign the SBOM with Sigstore](https://www.sigstore.dev/) and upload it to a known artifact location so users are able to associate images with this trusted information.

NOTE: this is likely to require some additional configuration options for pushing to registries, use a signing key, etc.. and may be better served as a separate action.

Start by clarifying whether this belongs in sbom-action or a separate action, then define the registry-push configuration and Sigstore signing requirements. Done means a scanned registry image's SBOM is signed and uploaded to a known artifact location so users can associate it with the image.

Written by the indexing model from the issue text.