drop support for CycloneDX SBOMs

[imjasonh]

Despite CycloneDX being described as one of the default SBOM formats, when publishing, we pick the first one (which is spdx by default) and publish that only.

apko/pkg/build/oci/sbom.go

Lines 153 to 157 in 4f9a4c6

	if len(matched) > 1 {
	// When we have multiple formats, warn that we're picking the first.
	logger.Warnf("multiple SBOM formats requested, uploading SBOM with media type: %s", mt)
	}
	path = matched[0].Path

As a result, this code path is effectively never used (by Chainguard, at least), and since there are no tests or validation we have no idea whether this works or will continue to. Instead of having effectively dead code, let's just remove it.

TF-apko already only supports SPDX (ref)

[imjasonh]

On second thought, let's not go to Camelot. 'Tis a silly place.