SBOM parsing improvements.

[oliverchang]

Addresses part of #335

1. Be more relaxed about filename matching the spec when the SBOM is explicitly passed via --sbom since we've seen multiple complaints from different users about this.
2. Surface all parse errors when SBOM parsing fails (and we're explicitly scanning via --sbom).

This will look something like:

Failed to parse SBOM using all supported formats:
failed to parse SPDX:
        failed trying json: failed to parse Supplier 'Google LLC'
        failed trying rdf: found extra chars before tag start
        failed trying tv: no colon found in '{'
failed to parse CycloneDX:
        failed trying json: invalid BOMFormat
        failed trying xml: XML syntax error on line 74: expected attribute name in element
No package sources found, --help for usage information.
exit status 128

[oliverchang]

@another-rex does this look reasonable to you?

[another-rex]

LGTM, just FYI the SPDX 0.5.0 has also been recently released which changes the interface up again, so this might need further tweaking when we upgrade that dependency.

[oliverchang]

yep, will address that separately later!