Ensure components are ingested in a consistent order

What does this MR do and why?

When generating SBoMs, Trivy sorts components by the bomRef attribute, which can either be the package URL of the dependency, or a UUID. When it is a UUID, it results in components being in a random order. When this happens, it causes deadlocks when ingesting SBoMs, as the inserts acquire locks on random rows and this can sometimes result in circular locking. This change ensures that components are always ordered consistently prior to ingestion, which will allow the locks to be acquired and released in order.

Fixes: #404630 (closed)

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Difficult to reproduce locally. Only happens with several concurrent workers executing at once.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.