fix: allow bom build and verification for `build_only` layers

[rchincha]

From our experience, package information may be removed in such layers making it much harder to discover and auto-construct BOMs.

So allow this for build_only layers also.

What type of PR is this?

Which issue does this PR fix:

What does this PR do / Why do we need it:

If an issue # is not available please add repro steps and logs showing the issue:

Testing done on this change:

Automation added to e2e:

Will this break upgrades or downgrades?

Does this PR introduce any user-facing change?:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 18.18182% with 18 lines in your changes are missing coverage. Please review.

Project coverage is 57.45%. Comparing base (86ba851) to head (8f9e200).

Files	Patch %	Lines
pkg/stacker/build.go	22.22%	11 Missing and 3 partials :warning:
pkg/stacker/bom.go	0.00%	4 Missing :warning:

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #609 +/- ## ========================================== + Coverage 57.40% 57.45% +0.04% ========================================== Files 65 65 Lines 7709 7711 +2 ========================================== + Hits 4425 4430 +5 + Misses 2527 2525 -2 + Partials 757 756 -1 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.