Upload SBOM directly to OCI registry

**What would you like to be added**:

cosign supports attaching SBOMs to OCI registries[^1] (also has a spec for it [^2]), so we (w/@dentrax) thought that it would be nice to have the same one for Syft, here is the design that we thought.

```shell
$ syft packages -o oci:///
```

**Why is this needed**:

**Additional context**:
[^1]: https://github.com/sigstore/cosign/blob/1f67ea73113f76c62429aa605d75105d77c370fa/cmd/cosign/cli/attach.go#L57
[^2]: https://github.com/sigstore/cosign/blob/main/specs/SBOM_SPEC.md

cc: @dlorenc @luhring