Attach HasSboms to Artifacts instead of Packages when possible

[mdeicas]

When a digest is available for the subject of an SBOM, the HasSbom node should be attached to an Artifact corresponding to that digest, and then an IsOccurrence should link the Artifact to a Package.

@pxp928 identified a few more places where code changes are needed:

• update the Vuln CLI to take in hash to search for hasSBOM
• Update the patch planning CLI to use hasSBOM dependencies and not direct isDependency when calculating patch plan

[nathannaveen]

Could I work on this?

Specifically finishing up these parts:

• update the Vuln CLI to take in hash to search for hasSBOM
• Update the patch planning CLI to use hasSBOM dependencies and not direct isDependency when calculating patch plan