Draft: Switch from sbom top-level key to cyclonedx

What does this MR do and why?

This is an report syntax to the one introduced in this MR: !91510 (merged)

The alternative report syntax looks like this:

artifacts:
  reports:
    cyclonedx:
      - artifact1
      - artifact2

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #360766 (closed)