Add base image information to SPDX SBOMs

[mattmoor]

WIP until #743 lands.

I'm going to split off the annotation change as well, but including here so that things work.

[codecov-commenter]

Codecov Report

Merging #744 (50f5c0f) into main (d17aca8) will decrease coverage by 0.18%.
The diff coverage is 31.34%.

@@            Coverage Diff             @@
##             main     #744      +/-   ##
==========================================
- Coverage   51.38%   51.19%   -0.19%     
==========================================
  Files          44       44              
  Lines        3295     3313      +18     
==========================================
+ Hits         1693     1696       +3     
- Misses       1390     1404      +14     
- Partials      212      213       +1     

Impacted Files	Coverage Δ
pkg/commands/deps.go	13.59% <0.00%> (+0.50%)	⬆️
pkg/build/gobuild.go	60.10% <32.30%> (-1.35%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d17aca8...50f5c0f. Read the comment docs.

[mattmoor]

I broke off the annotation change here: #745

[mattmoor]

cc @puerco