Our SBOMs should reference the base image's SBOMs

Currently our SBOMs only capture the contents of the Go binary we overlay on the base image, but it should be possible to (at least) discover the SBOM for the base image, or capture its contents.

I believe the prevailing wisdom (from @puerco) is to reference the base image's SBOM, and there is some precedent for "external references" in SBOMs such as this "external reference" from the K8s SBOMs
```
ExternalDocumentRef:DocumentRef-kubernetes-v1.23.5 https://sbom.k8s.io/v1.23.5/source SHA1: c7c35638348a5c2cf6d3af72cfdc94a66e33252b
```

I think the work here would be:
1. Detect whether our base image has an SBOM, and if so
2. Encode some sort of `ExternalDocumentRef` into our image-level SBOMs.

cc @jdolitsky @imjasonh @jonjohnsonjr

No files, tests, or entry points are named. Start by locating the code that generates the image-level SBOM and how the base image is resolved, then investigate how a base-image SBOM can be discovered and represented with an ExternalDocumentRef. Done means the generated SBOM references the base image's SBOM when one exists.

Written by the indexing model from the issue text.