rebuild: make SBOM more reproducible

[imjasonh]

With this change:

$ go run ./ rebuild <(curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk)
$ diff \
  <(tar -Oxf x86_64/crane-0.20.3-r2.apk var/lib/db/sbom/crane-0.20.3-r2.spdx.json) \
  <(curl -sL https://apk.cgr.dev/chainguard/x86_64/crane-0.20.3-r2.apk | tar -Ox var/lib/db/sbom/crane-0.20.3-r2.spdx.json)
8c8
<       "Tool: melange (devel)",
---
>       "Tool: melange (v0.19.4)",

This should go away if I was using melange 0.19.4 to rebuild, which of course I'm not. Once a version of melange is released with rebuild and is used to build packages, this diff should disappear 🪄

Diffs to rebuilt file owner groups and .melange.yaml still persist.