for multi-platform manifest, it puts the attestation on
the actual (amd64) image instead of its manifest

fix(sbom): attest digest instead of tag

Closes #144

See merge request !170

## [7.4.1](7.4.0...7.4.1) (2025-09-02)

### Bug Fixes

* **sbom:** attest digest instead of tag ([390f1f23](390f1f23))
* **sbom:** report native json and convert for digest ([a46225ba](a46225ba))