Add a custom BuildKit SBOM generator for extension images

[ardentperf]

Summary

This PR adds a BuildKit SBOM generator for CNPG extension images. It produces
platform-specific SPDX SBOMs for the shipped extension payload while retaining
package ownership, license findings, and optional downstream metadata hooks.

Changes

• Add the cnpg-sbom-generator container and its Python generator, SPDX
  composer, optional augmentation hook, and regression tests.
• Publish the generator as
  ghcr.io/cnpg-extensions/cnpg-sbom-generator.
• Integrate the generator with the extension Bake workflow and expose the
  builder stage required for package and license evidence.
• Use BuildKit's native type=sbom attestation when sbom_generator is not
  configured; use the custom generator when an image reference is supplied.
• Split large license files at License: sections before ScanCode runs, then
  normalize the results back to their original paths.
• Document the generator protocol, downstream hook, attestation layout, and
  verification workflow.
• Add a Trivy SBOM example for the pgagent bookworm image.

Validation

• python3 -m unittest discover -s sbom-generator/tests -p 'test_*.py'
  — 15 tests passed.
• Ran the SBOM generator workflow locally with nektos/act and pushed the
  renamed generator image to a local registry.
• Ran the h3 extension Bake job locally with nektos/act; the bookworm and
  trixie builds completed successfully using the renamed generator image.
• Verified the Bake definition renders both the native type=sbom fallback
  and the custom type=sbom,generator=... form.
• Captured Trivy vulnerability and license output for pgagent bookworm in
  examples/trivy-sbom-examples.txt.

GitHub-only OIDC, signing, and hosted-runner attestation steps were not run in
the local environment. The temporary Act/local-registry workflow overrides
used for testing are not included in this PR.