Add 40 Docker Hub images and TEA dedup workflow

[vpetersson]

Summary

• Add SBOM extraction configs and trigger workflows for the top 40 Docker Hub official images (by pull count), including: postgres, python, node, mysql, mongo, httpd, rabbitmq, traefik, mariadb, golang, alpine, ubuntu, debian, ruby, wordpress, php, sonarqube, haproxy, influxdb, nextcloud, tomcat, maven, eclipse-mosquitto, telegraf, bash, ghost, solr, kong, zookeeper, neo4j, gradle, mongo-express, eclipse-temurin, perl, cassandra, drupal, memcached, registry, redis, and nginx (chainguard)
• Add TEA Sync hourly scheduled workflow (tea-sync.yml) that detects docker/chainguard apps and triggers the SBOM builder — deduplication is handled in the builder itself
• Update sbom-builder.yml to a three-phase approach: (1) build augmented SBOM locally without upload, (2) check TEA for existing SBOM hash, (3) upload only if the SBOM is new
• Fix docker-attestation.sh — multi-arch manifest handling was broken (used --platform which skips index-level attestation manifests)
• Skip semver validation for docker/chainguard source types (versions are Docker tags, not always semver)
• Rename sbomify/github-action → sbomify/sbomify-action
• Add product_id to dependency-track configs

Test plan

• Verified SBOM fetch works for 19+ images locally (postgres, python, node, mysql, httpd, alpine, memcached, traefik, golang, haproxy, influxdb, sonarqube, neo4j, eclipse-temurin, registry, kong, debian, ubuntu, redis)
• Verified SBOM upload to sbomify works (redis end-to-end)
• Verified TEA dedup correctly detects already-published SBOMs
• Confirmed all Docker official images produce SPDX 2.3 SBOMs
• Removed nats and adminer (only have SLSA provenance, no SBOM attestation)
• CI validation (dry-run mode)

🤖 Generated with Claude Code