Grype 应该查找和分析 SBOM 认证

What would you like to be added:

When Grype analyzes an OCI container, it should query the container registry for OCI artifacts. If the artifacts include SBOM attestations, Grype should download them from the registry, decode their base64-encoded payload, and then analyze the embedded SBOM (which is in either CycloneDX or SPDX format). Possibly related: https://GitHub.com/anchore/grype/issues/519.