Update the SBOM merge script to handle the newer metadata.tools format

[brunoapimentel]

There's a new version of the CycloneDX (1.5) which introduced changes in the way to specify .metadata.tools, and marks the current format as deprecated.

CycloneDX 1.4:

{
   "metadata": {
      "tools": [
          {
             "vendor": "red hat",
             "name": "cachi2"
          }
      ]
   }
}

CycloneDX 1.5:

{
   "metadata": {
      "tools": {
        "components": [
            {
               "type": "application",
               "author": "red hat",
               "name": "cachi2"
            }
        ]
    }
}

Syft has also adopted the newer format starting from version 0.99.0. This makes the 'merge_syft_sbom.py' script to fail in case a newer Syft SBOM is used. This PR also updates the script so both formats can be handled in Syft SBOMs.

Maintainers will complete the following section

• [x] Commit messages are descriptive enough
• [x] Code coverage from testing does not decrease and new code is covered
• [n/a] Docs updated (if applicable)
• [n/a] Docs links in the code are still valid (if docs were updated)

[brunoapimentel]

We should probably also create a mechanism to add the current Cachi2 version to the metadata.tools output:

  "metadata": {
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "red hat"
          "name": "cachi2",
          "version": "0.4.0"
        }
      ]
    }
  }

[taylormadore]

Do we need to bump the schema version we're using in the integration tests? https://github.com/containerbuildsystem/cachi2/blob/eb4cb6c9bd2dedbd8cd766c086fa16db290ffbfb/tests/integration/utils.py#L33-L35

[brunoapimentel]

New pushes: added a commit that updates the merge_syft_sbom.py script.

[chmeliik]

Blocks https://github.com/redhat-appstudio/build-definitions/pull/722, which blocks the latest rh-syft build

(Syft < 0.99.0 panics when processing the source directory of Syft >= 0.99.0)

[brunoapimentel]

New push completely reworks the PR:

• To avoid breaking changes, we're keeping Cachi2's SBOM in CycloneDX 1.4
• The merge script is updated so either .metadata.tools format can be handled (assuming Cachi2's SBOM will be kept in 1.4)