feat(sbom): add --json output to fossa sbom analyze

[zlav]

Overview

Add a --json flag to fossa sbom analyze that, on a successful upload, prints project metadata as JSON to stdout — reusing the exact renderer/schema as fossa analyze --json so downstream tooling parses both identically.

• src/App/Fossa/Config/SBOM/Analyze.hs — add --json flag (analyze's JsonOutput helper + identical help text); thread it through SBOMAnalyzeOptions → SBOMAnalyzeConfig.
• src/App/Fossa/SBOM/Analyze.hs — after upload, emit buildProjectSummary JSON to stdout when --json is set. The human "View FOSSA Report" banner is kept alongside the JSON, matching analyze.
• src/App/Fossa/Analyze/Upload.hs — export buildProjectSummary for reuse (no schema change).
• Docs (sbom.md) and Changelog.md updated.

Parity: emits the same object as fossa analyze --json (project, projectId, revision, branch, url, id). SBOM projects use the sbom fetcher, so id is sbom+<orgId>/<name>$<rev> (not custom).

Acceptance criteria

fossa sbom analyze <file> --json prints a JSON object with the project locator/id and report URL in the same schema as fossa analyze --json, enabling scripted fossa project edit --project-locator ... follow-ups.

Testing plan

• cabal build lib:spectrometer — compiles.
• cabal test unit-tests --test-options='--match "SBOM Analyze"' — passes, including new cliParser cases asserting --json parses on/off.
• fourmolu --mode check on changed files — clean.

Risks

Low. Locator uses the sbom fetcher (verified) rather than custom; JSON shape is unchanged from analyze.

Metrics

N/A.

References

• ANE-3067 (related context only — that ticket tracks the sibling --project-label gap, which is not addressed here).

Checklist

• I added tests for this PR's change.
• If this PR introduced a user-visible change, I added documentation into docs/.
• If this PR added docs, I added links as appropriate to the user manual's ToC.
• If this change is externally visible, I updated Changelog.md under ## Unreleased.
• If I made changes to .fossa.yml or fossa-deps.{json.yml}, I updated schemas. (N/A)
• If I made changes to a subcommand's options, I updated docs/references/subcommands/<subcommand>.md.