Update Sbom scan api and CVS workflow to add files under location for findings

What does this MR do and why?

Update Sbom scan api and CVS workflow to add files under location for findings.

References

Related issue: CVS & SBOM Scan API Extension - Generate files ... (#592109 - closed) • Zamir Martins • 18.11

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Pick a project where there is a pipeline
2. Fetch job information like the following:

pipeline = Ci::Pipeline.last  # or find one from a project you control
job = pipeline.builds.first
job.update(status: :running)
job.ensure_token!
puts job.reload.token
puts job.id

3. Trigger a sbom scan with this file :

curl -s -X POST "http://gdk.test:3000/api/v4/jobs/<JOB_ID>/sbom_scans" \
  -H "JOB-TOKEN: <JOB_TOKEN>" \
  -F "file=@/path/to/sbom.json"

4. Fetch the output file:

curl -s "http://gdk.test:3000/api/v4/jobs/<JOB_ID>/sbom_scans/<SCAN_ID>" \
  -H "JOB-TOKEN: <JOB_TOKEN>"

5. The expectation is that the findings in the file above will have files under location matching the values from the sbom file aboe (under metadata.component.components[]). As the following example:

$ jq '.findings[0].location' test.json

{
  "file": "subdir1/Gemfile.lock",
  "dependency": {
    "package": {
      "name": "rack"
    },
    "version": "2.0.4"
  },
  "files": [
    {
      "path": "subdir1/Gemfile",
      "type": "requirements",
      "in_repository": true
    },
    {
      "path": "subdir1/Gemfile.lock",
      "type": "lockfile",
      "in_repository": true
    }
  ]
}

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.