If SBOM ref has .json suffix, assume JSON mediatype

[jdolitsky]

When attaching a CycloneDX SBOM:

$ cosign attach sbom --type=cyclonedx --sbom=./sbom.json example.com/testing123:v0.1.0
WARNING: Attaching SBOMs this way does not sign them. If you want to sign them, use 'cosign attest -predicate ./myclone.json -key <key path>' or 'cosign sign -key <key path> <sbom image>'.
Uploading SBOM file for [example.com/testing123:v0.1.0] to [example.com/testing123:v0.1.0:sha256-*****.sbom] with mediaType [application/vnd.cyclonedx+xml].

The mediatype defaults to application/vnd.cyclonedx+xml, even though the incoming SBOM path has a .json extension.

This PR tries to help make a more educated guess as to the proper mediatype to use.

[codecov-commenter]

Codecov Report

Merging #1859 (3e05e82) into main (7a3c04f) will decrease coverage by 0.01%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #1859      +/-   ##
==========================================
- Coverage   33.44%   33.43%   -0.02%     
==========================================
  Files         146      146              
  Lines        9340     9344       +4     
==========================================
  Hits         3124     3124              
- Misses       5843     5847       +4     
  Partials      373      373              

Impacted Files	Coverage Δ
cmd/cosign/cli/options/attach.go	0.00% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7a3c04f...3e05e82. Read the comment docs.

[hectorj2f]

lgtm

[hectorj2f]

Perhaps we could do the same with xml sbom files.