Add ability to verify SBOM

[colek42]

The user should be able to perform a protobomit verify against the generated SBOM. We should pull the associated attestations and policy files from the external references and validate them

• add external reference to the policy used
• add a new cobra command