Support SBOM creation for container image indexes

What would you like to be added:
Create an SBOM when given a container reference that points to a container image index that includes the dependencies of all the image manifests the index points to.

Why is this needed:
Multi-architecture and multi-platform container images are becoming more common.

Additional context:
Syft supports creating an SBOM from a container reference. When given a reference, Syft will pull the reference to download the container image. When the reference points to a container image index, Syft will download one of the underlaying images depending on that platform the tool is run on, and generate an SBOM from that image. That means that the dependencies of the alternate images are not cataloged and documented in the SBOM, creating a visibility gap.

Syft should optionally download each underlaying image and document the dependencies in all of them. Ideally Syft would model the image index and image manifests as packages in the SBOM with appropriate relationships, so that the dependency graph information is recorded.

Start by tracing Syft’s handling of container references and image indexes, then inspect how SBOM packages and relationships are represented. Done means an index reference can optionally cover every underlying manifest and the resulting SBOM records the index, manifests, and dependency relationships; the issue names no files or tests to run.