generate SBOM both SPDX and Cyclone DX formats based for container images and attach em by using cosign attach

We (w/@dentrax) thought that [Syft](https://github.com/anchore/syft) is a popular tool to allows us to generate SBOMs easily and quickly. Even [GoReleaser](https://github.com/goreleaser/goreleaser/issues/2597) project using syft under the hood to generate an SBOM. We have recently added cosign support to sign and verify container images while building/pushing and pulling in nerdctl. So, cosign has [SBOM spec](https://github.com/sigstore/cosign/blob/main/specs/SBOM_SPEC.md) defined to let people attach SBOM (both SPDX and Cyclone DX formats) files to container images by using cosign attach command.

So, let's add that support to the nerdctl CLI too. We can generate an SBOM file while pushing the container image, then attach the SBOM file to it.

WDYT?

cc: @dlorenc @AkihiroSuda @luhring @wagoodman