DLPX-98872 linux-pkg: generate per-package CycloneDX SBOM via Syft deb scan and publish S3 sidecar

[justsanjeev]

Problem

Phase 1 (#414 + appliance-build#892) gives every image a flat, dpkg-only
CycloneDX base scan. That's correct for 3rd-party debs but wrong for
Delphix's own first-party packages (masking, virtualization,
delphix-sso-app, containerized-masking, windows-connector, zfs, ptools,
delphix-rust), which bundle third-party components across ecosystems
(jars, npm, wheels, Rust crates) invisible to dpkg.

Solution

Adds SBOM_DEEP_SCAN as a per-package opt-in flag, a CI lint requiring
every package to be explicitly classified, and generate_sbom() (wired
as a new buildpkg.sh stage) which runs Syft against a flagged
package's built .deb(s) -- merging via cyclonedx-cli when a package
emits more than one .deb -- to produce a .cdx.json sidecar.
No new S3 upload plumbing is needed: the existing artifacts/ sync
already picks it up.

This is Phase 2 (CP-13465, Jira DLPX-98872) of the CycloneDX SBOM
effort (Epic CP-13455). Full design in
docs/specs/2026-09-08-sbom-per-package-sidecar-design.md.

Stacked on #414 (Phase 1's syft/cyclonedx-cli packages), which this
depends on.

Testing Done

Verified locally (no build host available in this environment):

• .github/scripts/verify-sbom-scan-flag.sh passes (all 40 packages classified)
• .github/scripts/verify-query-packages.sh still passes
• shellcheck / shfmt clean on all touched files

Not yet verified against a real build host: that syft can scan a
standalone .deb directly, and an end-to-end zfs (multi-deb) + masking
(single-deb) build producing a valid sidecar in S3. Tracked as a
follow-up before merge.