fix(sbom): reuse grype database provider

[leodido]

Summary

• initialize the embedded Grype vulnerability database once per scan operation
• retry database initialization up to three times with bounded backoff
• reuse and close one provider across all package SBOM scans
• preserve lazy initialization when no package is eligible for scanning

Motivation

Leeway currently loads and auto-updates Grype's database inside each package scan. When the initial database download fails, every package repeats the same download attempt, turning one transient failure into a long build failure.

Preloading the database with a separate grype executable avoids that loop but couples Leeway to an independently versioned CLI and database schema. This change keeps database ownership inside Leeway's embedded Grype library.

Related investigation: https://github.com/gitpod-io/gitpod-next/pull/27991

Compatibility

• No exported API or workspace configuration changes.
• Individual SBOM parsing and matching failures continue to be collected across packages.
• Database initialization failures now stop after three attempts instead of being retried once per package.
• No external Grype CLI preload is required after consumers adopt a Leeway release containing this change.

Verification

• go test ./... -count=1
• go test -race ./... -count=1
• golangci-lint run ./... --new-from-rev HEAD
• git diff --check

The repository-wide local golangci-lint v2 run also reports pre-existing findings outside this diff; changed-line lint reports zero issues.

Documentation

No docs changes needed. This changes internal vulnerability-database lifecycle and failure handling without changing commands or configuration.