Simplify SBOM interaction

[rjaegers]

At the moment there are different SBOMs generated; one during the docker/build-push action stage that uses Syft and the integrated buildx SBOM function; an another one again using Syft but scanning the output image to eventually submit the results to the GitHub Dependency Submission API.

If issue docker/build-push-action#861 and/or docker/build-push-action#889 are solved this can be consolidated into the build-push stage.

As an alternative instead of scanning the image again, the attested SBOM could be retrieved and fed to the Dependency Submission API.

[github-actions]

This issue is marked stale because it has been open for an extended period with no activity. Remove the 'stale' label or comment otherwise this issue will be closed in 7 days.