Update the SBOM merge script to handle the newer metadata.tools format

[brunoapimentel]

There's a new version of the CycloneDX (1.5) which introduced changes in the way to specify .metadata.tools, and marks the current format as deprecated.

CycloneDX 1.4:

{
   "metadata": {
      "tools": [
          {
             "vendor": "red hat",
             "name": "cachi2"
          }
      ]
   }
}

CycloneDX 1.5:

{
   "metadata": {
      "tools": {
        "components": [
            {
               "type": "application",
               "author": "red hat",
               "name": "cachi2"
            }
        ]
    }
}

Syft has also adopted the newer format starting from version 0.99.0. This makes the 'merge_syft_sbom.py' script to fail in case a newer Syft SBOM is used. This PR also updates the script so both formats can be handled in Syft SBOMs.

Maintainers will complete the following section

• Commit messages are descriptive enough
• Code coverage from testing does not decrease and new code is covered
• [n/a] Docs updated (if applicable)
• [n/a] Docs links in the code are still valid (if docs were updated)

[brunoapimentel]

We should probably also create a mechanism to add the current Cachi2 version to the metadata.tools output:

  "metadata": {
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "red hat"
          "name": "cachi2",
          "version": "0.4.0"
        }
      ]
    }
  }

[taylormadore]

Do we need to bump the schema version we're using in the integration tests?

cachi2/tests/integration/utils.py

Lines 33 to 35 in eb4cb6c

	CYCLONEDX_SCHEMA_URL = (
	"https://raw.githubusercontent.com/CycloneDX/specification/1.4/schema/bom-1.4.schema.json"
	)

[brunoapimentel]

New pushes: added a commit that updates the merge_syft_sbom.py script.

[chmeliik]

Blocks konflux-ci/build-definitions#722, which blocks the latest rh-syft build

(Syft < 0.99.0 panics when processing the source directory of Syft >= 0.99.0)

[brunoapimentel]

New push completely reworks the PR:

• To avoid breaking changes, we're keeping Cachi2's SBOM in CycloneDX 1.4
• The merge script is updated so either .metadata.tools format can be handled (assuming Cachi2's SBOM will be kept in 1.4)

[chmeliik]

LGTM with minor nitpicks

[chmeliik]

nitpick: unnecessary elif condition

or missing else: explode

[brunoapimentel]

Added a else: explode.

[chmeliik]

nitpick:

Suggested change

	if type(syft_tools) is dict:
	if isinstance(syft_tools, dict):

[brunoapimentel]

Fixed.