feat: syft 3435 - add file components to cyclonedx bom output when file metadata is available

[spiffcs]

Description

This change updates syft to add cyclone-dx components with the type file when the underlying SBOM has coordinates that are mapped to their respective file metadata.

• Fixes cyclone-dx presenter drops files, includes only packages #3435

Example

export SYFT_FILE_METADATA_SELECTION="all"
go run cmd/syft/main.go -o cyclonedx-json dir:../stereoscope/ > sbom.json

Slice of new file types from output

    {
      "bom-ref": "7a9779339fe3868f",
      "type": "file",
      "name": "/Users/hal/development/stereoscope/.DS_Store",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "c918669c6ac5631bee00ceaef5f2e8a023945697"
        },
        {
          "alg": "SHA-256",
          "content": "3617159d3c3333bda8497d3c60fdda46f5ce0ab72bf3ba772dbb9128e0aca2d5"
        }
      ]
    },
    {
      "bom-ref": "ec6f846aad26adea",
      "type": "file",
      "name": "/Users/hal/development/stereoscope/.binny.yaml",
      "hashes": [
        {
          "alg": "SHA-1",
          "content": "41928b763c5478f3bc3ddde1135b0ece1536ff86"
        },
        {
          "alg": "SHA-256",
          "content": "fb6962a7f181dd5bb3e74ba637b83e91800197863b7d56cb53a6a6b96cb78668"
        }
      ]
    },

Type of change

• New feature (non-breaking change which adds functionality)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections