Support automatically uploading SBOMs

https://github.com/bytecodealliance/wasm-tools/pull/2082 has added support for extracting SBOM data encoded in custom sections in Wasm binaries (`.dep-v0`). When uploading components to OCI registries, it would be neat if we could automatically look for the presence of this metadata and upload it to the registry as an attachment if present.

I'm not too picky on what the format of the attachment should be, we might even want to enable users to configure it. But I propose that at least initially we encode this as the CycloneDX format, since the [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) project already provides a crate to do that.

The end-to-end flow I'm envisioning here is to have tools such as `cargo-component` and `jco` encode dependency info by default as part of their build. Enable tools such as `wasm-metadata` to read this metadata and display it to users. And have tools such as `wkg` handle this metadata during packaging, convert it to the right formats for ingestion, and upload it to the registry.

I hope this makes sense, thanks!

cc/ @shnatsel and @pchickey for awareness