bug(sbom): packages layers are not saved in sbom mode.

[DmitriyLewen]

Discussed in #5424

We save DiffIDs and Digests of packages in SBOM formats:

• CycloneDX - properties of component:

    "component": {
          "bom-ref": "pkg:pypi/[email protected]?file_path=usr%2Flocal%2Flib%2Fpython3.9%2Fsite-packages%2Fpip-23.0.1.dist-info%2FMETADATA",
      "type": "library",
      "name": "pip",
      "version": "23.0.1",
      "licenses": [
        {
          "license": {
            "name": "MIT"
          }
        }
      ],
      "purl": "pkg:pypi/[email protected]",
      "properties": [
        {
          "name": "aquasecurity:trivy:FilePath",
          "value": "usr/local/lib/python3.9/site-packages/pip-23.0.1.dist-info/METADATA"
        },
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:1def056a3160854c9395aa76282dd62172ec08c18a5fa03bb7d50a777c15ba99"
        },
        {
          "name": "aquasecurity:trivy:LayerDigest",
          "value": "sha256:de7a1221312a618b08638bf779ae3d529927397cf96df3b1eace8cf941a66959"
        },

• SPDX - attributionTexts of packages:

  "packages": [
    {
      "name": "adduser",
      "SPDXID": "SPDXRef-Package-d78bccd9a666f87d",
      "versionInfo": "3.118+deb11u1",
      "supplier": "Organization: Debian Adduser Developers \u003c[email protected]\u003e",
      "downloadLocation": "NONE",
      "sourceInfo": "built package from: adduser 3.118+deb11u1",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "copyrightText": "",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:deb/debian/[email protected]%2Bdeb11u1?arch=all\u0026distro=debian-11.8"
        }
      ],
      "attributionTexts": [
        "PkgID: [email protected]+deb11u1",
        "LayerDigest: sha256:e67fdae3559346105027c63e7fb032bba57e62b1fe9f2da23e6fdfb56384e00b",
        "LayerDiffID: sha256:633f5bf471f7595b236a21e62dc60beef321db45916363a02ad5af02d794d497"
      ],

When we scan sbom files - we need to include digests in packages and vulnerabilities (like we do for the json format).

See more in #5424