Add SBOM generation fallback implementation for registries that do not support automatic SBOM generation

### Main idea

### Implementation Idea

I think we can use [syft](https://github.com/anchore/syft). What do you think about embedding the syft binary in the manager pex?

If we embed syft into the manager, we could create a command like backend.ai mgr image inspect-dependencies to generate reports on the image's dependencies.

However, it might be more practical to embed syft into the agent instead. Because images will be installed on the nodes where the agent is installed.

In this case, the manager wouldn’t need to pull the image if it’s already installed on an agent node.Instead, the manager could send an RPC call to that agent to generate the report and then retrieve the result.

JIRA Issue: BA-46