Validate Backend.AI image labels using SBOM

[jopemachine]

Main idea

When building and pushing a new image by adding label information and additional installation commands to an existing image through the Forklift (or Control panel), let's verify the image labels by comparing them with the SBOM before pushing the image.

To achieve this, we need to implement APIs for image validation.

[jopemachine]

The validation check during the image build stage cannot rely on the SBOM generated by the registry, as the image has not yet been pushed to the registry.

IMHO, One alternative could be to create separate APIs to generate SBOM directly using syft.
While generating SBOM itself may take a relatively long time, since the API caller who is attempting to push a local image already have the image on the host, we won't need to consider image pulling time.