Attach SBOMs to images in the container registry

- https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/attach-sbom
- https://oras.land/blog/oras-0.14-and-future/#attach-the-sbom-to-this-image

We can use the ORAS tool to directly attach SBOMs to our images in our container registry. This makes the content of our images more discoverable and opens up the possibility for automation based on the SBOM (for example, rebuilds when we have CVEs or package updates). This can decouple the "scanning" of the image from the actions based on that scan.

SBOMs are an attestation/supply chain artifact and can also be **signed**:


### Example

#### SBOM Discovery

```
$ oras discover -o tree $IMAGE

myregistry.azurecr.io/net-monitor:v1
├── sbom/example
│   └── sha256:4f1843833c029ecf0524bc214a0df9a5787409fd27bed2160d83f8cc39fedef5
│   └── signature/example
│   └── sha256:3c43b8cb0c941ec165c9f33f197d7f75980a292400d340f1a51c6b325764aa93
├── readme/example
│   └── sha256:5fafd40589e2c980e2864a78818bff51ee641119cf96ebb0d5be83f42aa215af
└── signature/example
└── sha256:00da2c1c3ceea087b16e70c3f4e80dbce6f5b7625d6c8308ad095f7d3f6107b5
```

### Additional Context

Related:
- #4589
- https://github.com/dotnet/dotnet-docker/issues/1455