[sbom] Release oci sboms have low precision

[prabhu]

Each cdxgen release ships with an SBOM (cdxgen-oci-image.cdx.json) for the default container image, but its accuracy is limited. It currently misses binaries installed directly by tools like wget, sdkman, and nvm. Improving this will be a challenge, and I’m honestly surprised no one has called out this issue before.