feat(material): enable no strict validation for cyclonedx sbom

[Piskoo]

Summary

• Added --no-strict-validation flag to attestation add command to allow bypassing JSON schema validation for CycloneDX SBOMs
• Added minimal type detection using the three required top-level CycloneDX fields (bomFormat, specVersion, version) per the CycloneDX spec
• When flag is enabled, schema validation errors are logged as warnings instead of failing. The file still gets uploaded, if minimal type detection was passed kind will be auto-detected

$ chainloop att add --value sbom.json --kind SBOM_CYCLONEDX_JSON --name sbom --no-strict-validation
WRN error decoding file, strict validation disabled, continuing error="jsonschema:  ...
INF uploading sbom.json - sha256:3dd44aa6515568349d73204c38dad0f4113c95234af2f5fe84c8eeed952262f8
INF material added to attestation
┌─────────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name        │ sbom                                                                    │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type        │ SBOM_CYCLONEDX_JSON                                                     │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
...

Closes #2723