Proposal: Stream sbom to disk (avoiding large memory footprint and OOMs)

**What would you like to be added**:
Currently, Syft builds the sbom report in memory before writing it to disk. I propose that instead of building in memory, we stream directly to disk.

**Why is this needed**:
To avoid OOMs

**Additional context**:
SBOM generation:
https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/scan.go#L199
https://github.com/anchore/syft/blob/main/internal/task/package_task_factory.go#L116
https://github.com/anchore/syft/blob/main/syft/create_sbom.go#L66

Report generation:
https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/scan.go#L208

Start by tracing SBOM generation in cmd/syft/internal/commands/scan.go, then inspect internal/task/package_task_factory.go and syft/create_sbom.go. Follow the report-generation path at scan.go and determine where the in-memory SBOM is assembled before disk output. Done means the report streams directly to disk without retaining the full SBOM in memory, with OOM risk reduced.

Written by the indexing model from the issue text.