Move cargo-cyclonedx off Alpine edge once it's packaged in a stable release

[brawer]

Summary

Containerfile currently pulls cargo-cyclonedx from Alpine's edge/community repo, added just for that one package:

# TODO: Take cargo-cyclonedx from stable Alpine Linux (not edge)
# once Alpine 3.24 has been released.
RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories && \
    apk update && \
    apk add \
      bash \
      build-base \
      cargo-cyclonedx@edge \
      ...

As of today, cargo-cyclonedx is only packaged in Alpine's edge/community, not in any stable (v3.x) branch yet. edge is Alpine's rolling/unstable branch, so relying on it -- even for a single, explicitly @edge-suffixed package -- means our SBOM tooling isn't built from a stable, versioned Alpine release the way the rest of the toolchain is.

What to do, once it's available

Once cargo-cyclonedx lands in an Alpine stable branch (3.24 is the next one due, per the existing TODO -- but check what's actually shipped by then, it may land later):

• Bump Containerfile's base image (FROM rust:1.97.1-alpine3.23 AS builder) to the corresponding stable Alpine version, if not already on it for other reasons.
• Drop the echo "@edge ..." >> /etc/apk/repositories line entirely.
• Drop the @edge suffix from cargo-cyclonedx@edge in the apk add list.
• Double check the stable-branch version of cargo-cyclonedx is recent enough (edge tends to run ahead); re-verify scripts/sbom/generate-sbom.sh and the SBOM it produces still look right, same as when Containerfile changes are normally tested (see the comment at the top of Containerfile for the manual podman build test invocation).

Priority

Low -- purely a hygiene improvement (moving one package off Alpine's rolling branch), nothing broken today, and it's gated on an upstream Alpine release that hasn't happened yet.