Ownership and automation and of external published repos in release process

**What would you like to be added**:

We have Syft published in:

* [Snap Store](https://snapcraft.io/syft)
* [WinGet Packages](https://github.com/microsoft/winget-pkgs/tree/master/manifests/a/Anchore/Syft)

I manually publish both of these. I want to discuss whether we could and should take ownership of them for syft (and grype).

The Snap is built via the config in [syft-snap](https://github.com/popey/syft-snap) and published in the Snap Store edge channel. I give that a shake and then promote it to the stable channel.
The WinGet package is published via pull requests to the [Syft WinGet repo](https://github.com/microsoft/winget-pkgs/tree/master/manifests/a/Anchore/Syft). I use [komac](https://github.com/russellbanks/Komac) - a community maintained manifest generator for WinGet packages. e.g. `komac update Anchore.Syft --version 1.23.1 --urls https://github.com/anchore/syft/releases/download/v1.23.1/syft_1.23.1_windows_amd64.zip`.

**Why is this needed**:

* Save some manual work for @popey
* Have faster releases in the above locations

**Additional context**:

Review the syft-snap configuration and the Anchore/Syft manifests in the WinGet Packages repository, along with the Komac update example. Determine the ownership and automation approach for publishing Syft and Grype to the Snap Store and WinGet; done means the agreed release process is defined and manual publishing work is reduced.

Written by the indexing model from the issue text.