Feature Request: Enhance --source-supplier with Contact Info and SPDX Creator Attribution

**What would you like to be added**:

Enhance the `--source-supplier` flag to support contact information and consistent creator attribution across formats:

1. Allow setting `metadata.supplier.contact` in CycloneDX format (e.g., email, phone)
2. When `--source-supplier` is set, also add it to `creationInfo.creators` with "Organization:" prefix in SPDX format

**Why is this needed**:

The `--source-supplier` flag added in #4131 is great for setting the package supplier, but has some limitations:

1. **Incomplete supplier information**: CycloneDX's `OrganizationalEntity` type supports contact details (email, phone, etc.), but currently we can only set the name. For compliance and provenance tracking, contact information is often required.

2. **Inconsistent behavior between formats**:
- In **CycloneDX**: Supplier is set in both `metadata.supplier` and `metadata.component.supplier`
- In **SPDX**: Supplier is only set on the root package's `supplier` field, but NOT in `creationInfo.creators`

3. **Simplifies the authors PR**: We have an open PR #4378 that adds `--authors` flag with support for `Person`, `Organization`, and `Tool` types. If `--source-supplier` handles organization creator attribution, we can simplify that PR to only handle `Person` and `Tool`

**Format examples:**

CycloneDX output:
```json
{
"metadata": {
"supplier": {
"name": "My Company",
"contact": [
{
"email": "contact@example.com"
}
]
},
"component": {
"supplier": {
"name": "My Company",
"contact": [
{
"email": "contact@example.com"
}
]
}
}
}
}
```

SPDX output:
```json
{
"creationInfo": {
"creators": [
"Organization: Anchore, Inc",
"Tool: syft-1.38.0",
"Organization: My Company (contact@example.com)"
]
},
"packages": [
{
"name": "alpine",
"supplier": "Organization: My Company (contact@example.com)"
}
]
}
```