Support passing a directory or list of sboms as input rather than needing to define a generator

**What would you like to be added**:

Sometimes we just want a static sbom rather than needing an image or generator from an image as input.

**Why is this needed**:

- We want to be able to compare vulnerability results across various sbom input formats
- Ability to more quickly add and label specific test cases without needing to build an entire base image and having to additionally label all of the junk that that brings in
- Ability to have comparisons for sboms with proprietary software components in them which we would not be able to provide a public image for

Start by tracing how Yardstick currently accepts generator-based input and how SBOMs flow into vulnerability-result comparisons. Identify the relevant input and comparison entry points, then define the supported directory and list forms; done means static SBOMs can be compared without an image generator, including proprietary-component test cases.

Written by the indexing model from the issue text.