feat(sbom): allow marking SBOMs as vendor-sourced

As part of changes in #530, we've made it possible to store additional
metadata for SBOMs, while breaking the requirement that we have a Repo
Key for a given SBOM, which makes it readily possible for us to surface
the dependency data coming from a vendor and product (version).

This introduces the new columns in the database schema, and adds
validation for them in the database.

Closes #352.