fix(sbom): use Annotation instead of AttributionTexts for SPDX formats

[DmitriyLewen]

Description

use Annotation instead of AttributionTexts for package properties.

examples:

• Packages:
  before:

   "attributionTexts": [
      "PkgType: conda-pkg"
    ],
  

  after:

  "annotations": [
    {
       "annotator": "Tool: trivy-dev",
       "annotationDate": "2021-08-25T12:20:30Z",
       "annotationType": "OTHER",
       "comment": "PkgType: conda-pkg"
    }
  ]
  

• ContainerImage:
  Before:

    "attributionTexts": [
    	"SchemaVersion: 2",
    	"ImageID: sha256:49193a2310dbad4c02382da87ac624a80a92387a4f7536235f9ba590e5bcd7b5",
    	"DiffID: sha256:dd565ff850e7003356e2b252758f9bdc1ff2803f61e995e24c7844f6297f8fc3",
    	"RepoTag: maven-test-project:latest",
    ],
  

  After:

    "annotations": [
    	{
    		"annotator": "Tool: trivy-dev",
    		"annotationDate": "2024-10-29T06:50:38Z",
    		"annotationType": "OTHER",
    		"comment": "SchemaVersion: 2"
    	},
    	{
    		"annotator": "Tool: trivy-dev",
    		"annotationDate": "2024-10-29T06:50:38Z",
    		"annotationType": "OTHER",
    		"comment": "ImageID: sha256:49193a2310dbad4c02382da87ac624a80a92387a4f7536235f9ba590e5bcd7b5"
    	},
    	{
    		"annotator": "Tool: trivy-dev",
    		"annotationDate": "2024-10-29T06:50:38Z",
    		"annotationType": "OTHER",
    		"comment": "DiffID: sha256:dd565ff850e7003356e2b252758f9bdc1ff2803f61e995e24c7844f6297f8fc3"
    	},
    	{
    		"annotator": "Tool: trivy-dev",
    		"annotationDate": "2024-10-29T06:50:38Z",
    		"annotationType": "OTHER",
    		"comment": "RepoTag: maven-test-project:latest"
    	}
    ],
  

Related issues

• Close Incorrect using of AttributionText in SPDX output #7756

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@goneall Could you take a quick look?

@DmitriyLewen We probably need to add the output before and after this change so @goneall can easily review it.

[DmitriyLewen]

@knqyf263 Tests show changes, but i added examples for Package and ContainerImage in PR description.

[goneall]

@knqyf263 @DmitriyLewen - Looks good - thanks!