feat: Add SBOMs for frontend (npm) dependencies

[dervoeti]

Description

Airflow, Druid, NiFi and Superset all bundle a frontend (npm) build, but their SBOM tooling (cyclonedx-py, CycloneDX Maven plugin) only covers the backend language. This adds a separate cdxgen-generated CycloneDX SBOM for the npm dependencies of each product's frontend, alongside the existing backend SBOM.

cdxgen 13.x requires Node >= 24, which is newer than the Node versions these products pin for their own frontend builds. Rather than bumping those, each affected Dockerfile installs a second, independent Node under /opt/node-cdxgen used only to run cdxgen, with that directory prepended to PATH for the cdxgen invocation.

As part of this, opensearch-dashboards (which already generated a frontend SBOM) is migrated from cdxgen 12.0.0 (@cyclonedx/cdxgen) to 13.0.1 (@cdxgen/cdxgen, the package was renamed for
13.x), and pins --spec-version 1.6 explicitly, since cdxgen's default spec version changes between releases and 1.6 is
the lowest version cdxgen 13 accepts as a generation target.

We still have some more uncovered JS code in our products (e.g. Trino UI), that will be a separate PR though since this is likely more complicated.

Definition of Done Checklist

• Changes are OpenShift compatible
• All added packages (via microdnf or otherwise) have a comment on why they are added
• Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
• All packages should have (if available) signatures/hashes verified
• Add an entry to the CHANGELOG.md file
• Integration tests ran successfully

[Techassi]

Generally looks good, just a few comments.

[Techassi]

Approved, just one last question.

[Techassi]

Well approving would actually help.