Provide way of seeing what components are bundled with a particular SDK without installing it

## Problem Statement
I am considering installing an SDK bundle and want to know what components are part of it or I am troubleshooting a problem I am encountering and want to establish what component versions are included

### Request
Provide a command `dpm version --show-components ` which will return the components and versions that are part of that particular sdk bundle, a la:

Ideally this is returned in machine parseable json rather than yaml

```
sdk-version: 3.5.0-pre-snapshot.20260504.530.0.v6b822f46

components:
canton-open-source:
version: 3.5.1-snapshot.20260505.18813.0.v23fb5203
codegen:
version: 3.5.1-snapshot.20260502.14674.0.vedd40eb4
daml-new:
version: 3.5.1-snapshot.20260502.14674.0.vedd40eb4
daml-script:
version: 3.5.1-snapshot.20260502.14674.0.vedd40eb4
daml-shell:
version: 0.1.15-main.20260430.136.919.eb9a2af
damlc:
version: 3.5.1-snapshot.20260502.14674.0.vedd40eb4
scribe:
version: 3.5.0-snapshot.20260428.573.7894.vee81b43f
upgrade-check:
version: 3.5.1-snapshot.20260502.14674.0.vedd40eb4

dpm:
version: 1.0.15-snapshot-20260502.126.0.v522bfa6
```

### Workaround
As a workaround pulling the direct OCI manifests, a command like this can be used

```
oras pull \
europe-docker.pkg.dev/da-images/public-unstable/sdk-manifests/open-source:3.5.0-pre-snapshot.20260504.530.0.v6b822f46 && cat 3.5*.yaml
```

Start at the implementation of the `dpm version` command and trace how SDK versions and OCI manifests are resolved. Compare its behavior with the documented `oras pull` workaround and determine how component versions can be exposed as machine-parseable JSON. Done means `dpm version --show-components ` reports the SDK version and bundled component versions without installing the SDK.

Written by the indexing model from the issue text.