fix: explicitly pick up SBOMs inside the container / specify CycloneDX version

[dervoeti]

Problem: SBOMs for our operator images do not contain cargo dependencies at the moment
We generate SBOMs for the Rust binaries at build time and Syft should pick them up to include the components in the SBOM for the container. This is done by the "SBOM cataloger" in Syft. Syft disabled the SBOM cataloger to run by default with this PR (released with Syft v0.102.0). The Syft version regularly gets bumped by stackable-bot (example), which indirectly disabled picking up the generated SBOMs in the container by bumping the Syft version.

This PR has two changes:

1. Pin CycloneDX version to 1.5 (was using the latest version by default, we can think about using 1.6 at some point, I haven't looked at the changes yet, just checked 1.5 when I implemented SBOM generation)
2. Explicitly enable sbom-cataloger

This also makes the Syft command exactly the same as in our product images.