DLPX-98654 [linux-pkg] Add syft/cyclonedx-cli packages

[justsanjeev]

Background

Companion to DLPX-98637 (delphix/syft) and DLPX-98638 (delphix/cyclonedx-cli) under the
CP-13455 CycloneDX SBOM epic. appliance-build PR #892 (CP-13464) provisioned Syft and
cyclonedx-cli by downloading pinned releases directly from github.com at build time;
review feedback flagged that as against convention. Design doc: DLPX-98618
(appliance-build/docs/specs/2026-08-13-syft-cyclonedx-cli-provisioning-design.md).

Problem

Syft and cyclonedx-cli need to be installed onto the appliance-build host (never inside the
shipped image) to generate and validate a CycloneDX SBOM for each built appliance. Neither
had a first-party linux-pkg package, so linux-pkg had no way to provision them -- they
were fetched directly from github.com at appliance-build build time instead, which is
inconsistent with how every other third-party build-host tool is provisioned in this org.

Solution

Add syft and cyclonedx-cli to main.pkgs, each with a packages/<name>/config.sh
pointing DEFAULT_PACKAGE_GIT_URL at the new first-party packaging repos
(delphix/syft, delphix/cyclonedx-cli) and calling dpkg_buildpackage_default, following
the exact delphix-go/host-jdks pattern. Both are listed only in main.pkgs -- never in
any appliance-build chroot package list -- so they stay build-host-only and are never
shipped inside the appliance image (see the comments added next to each in main.pkgs).

Testing Done

packages/syft/config.sh and packages/cyclonedx-cli/config.sh follow the same shape as
the existing delphix-go/host-jdks config files, which already build successfully through
this same linux-pkg path. The actual package builds (delphix-syft, delphix-cyclonedx-cli
.debs) are exercised via delphix/syft#1 and delphix/cyclonedx-cli#1, which fetch and
checksum-verify their pinned upstream releases from Artifactory and have been validated
end-to-end there.

[prakashsurya]

looks reasonable to me.. I presume, these repos follow the product's branch conventions (e.g. develop, release, etc.)?