feat: add support for custom metadata in SBOM uploads

[alexanderbsingh]

No description provided.

[Copilot]

Pull request overview

This PR adds support for attaching arbitrary user-defined metadata to SBOM upload requests, allowing callers (e.g., CI workflows) to provide extra context as query parameters alongside existing Git/image metadata.

Changes:

• Introduces a --metadata key=value flag that can be repeated to collect custom metadata.
• Adds CustomMetadata parsing and propagates it through the task layer into the API upload request query string (as metadata.<key>=<value>).
• Extends unit tests and documentation to cover valid/invalid metadata formats and query encoding behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Documents the new --metadata flag with an example and adds it to the options table.
internal/bifrost/sbom_upload.go	Wires parsed custom metadata into APIConfig when creating the API client for uploads.
internal/bifrost/options.go	Adds customMetadata to CLI options and registers the repeatable --metadata flag.
internal/bifrost/custom_metadata.go	Implements CustomMetadata and flag.Value parsing for key=value inputs.
internal/bifrost/cli_test.go	Adds CLI-level tests for valid/invalid metadata and special-character handling.
internal/bifrost/api.go	Appends custom metadata as metadata.<key> query parameters during upload.
internal/bifrost/api_test.go	Adds API-level test ensuring custom metadata query parameters are included and encoded as expected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[konrader]

I forgot what this feature was good for. Why do we need to support custom metadata field for SBOM upload?
The problem with it as I see is that there is no specification anywhere for what field we do support.