feat(STONEINTG-887): get base images from SBOM

[MartinBasti]

Task deprecated-image-check will fetch data about base images also from SBOM.

This requires incompatible change, because users must update PLR definition with new parameters.

In future, konflux will stop provide BASE_IMAGES_DIGESTS via parameter, thus this param is optional now (we cannot remove it yet)

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[MartinBasti]

Example

STEP-CHECK-IMAGES

Fething SBOM for image quay.io/mbasti-test-org/single-nodejs-app:d1e1c90@sha256:1492539a932605755ed1bec583d5db4896828c37fdd0c61ca096485de8d9e27c
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>' or verify its signature using 'cosign verify --key <key path> --attachment sbom <image uri>'.
Found SBOM of media type: application/vnd.cyclonedx+json
Detected base images from SBOM:

Base images pased by param BASE_IMAGES_DIGESTS: registry.access.redhat.com/ubi9/nodejs-16:<none>@sha256:c17111ec54c7f57f22d03f2abba206b0bdc54dcdfb02d6a8278ce088231eced1

Images to be checked:
registry.access.redhat.com/ubi9/nodejs-16

Querying Red Hat Catalog for registry.access.redhat.com/ubi9/nodejs-16.
Running conftest using /project/repository/ policy, required_checks namespace.
[
	{
		"filename": "/tmp/ubi9/nodejs-16/repository_data.json",
		"namespace": "required_checks",
		"successes": 1
	}
]
[SUCCESS] Image registry.access.redhat.com/ubi9/nodejs-16 is valid
{"result":"SUCCESS","timestamp":"1713542822","note":"Task deprecated-image-check completed: Check result for task result.","namespace":"required_checks","successes":1,"failures":0,"warnings":0}

[MartinBasti]

Example when base images are available in SBOM:

STEP-CHECK-IMAGES

Fething SBOM for image quay.io/mbasti-test-org/single-container-app:f2566ab@sha256:e3605c5646ae1f6524b750b12a6c29fab309d9862491b1cee51f3a28202a5b63
WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>' or verify its signature using 'cosign verify --key <key path> --attachment sbom <image uri>'.
Found SBOM of media type: application/vnd.cyclonedx+json
Detected base images from SBOM:
docker.io/library/node

Base images pased by param BASE_IMAGES_DIGESTS: docker.io/library/node:latest@sha256:162d92c5f1467ad877bf6d8a098d9b04d7303879017a2f3644bfb1de1fc88ff0

Images to be checked:
docker.io/library/node

Querying Red Hat Catalog for docker.io/library/node.
[WARNING] Registry/image docker.io/library/node not found in Red Hat Catalog. Task cannot provide results if image is deprecated.
{"result":"WARNING","timestamp":"1713542891","note":"Task deprecated-image-check completed: Check result for task result.","namespace":"required_checks","successes":0,"failures":0,"warnings":1}

[MartinBasti]

/retest

[MartinBasti]

/retest

[jsztuka]

lgtm

[MartinBasti]

Reverted to original code using cosign, we couldn't access workspace in parallel due to EBS storage.

Also removed unused result, to reuse version bump

[dirgim]

LGTM

[hongweiliu17]

Two minor comment. Others look good to me.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud