Add a workflows to test the ORT to ScanCode.io integration

[tsteenbe]

See individual commits for details.

[tsteenbe]

This PR is currently blocked due to #1885.

[tsteenbe]

@tdruez Could you help me debug this PR, have been running into issues with ScanCode.io detecting the right number of packages, vulnerabilities and dependencies?

[tdruez]

Hey @tsteenbe, sure I can help!

Changes:

• Set 0 expected packages for the "result-without-findings" SBOM afcd93c
• Set 0 expected vulnerability for the "SPDX YAML SBOM", no vulnerability data in SPDX output 946648f
• Enable the XML SBOM job, now properly supported edc8ca6
• Migrate part of the ORT workflow into the test suite.
• Add checks on unique vulnerabilities in SCA integrations testsuite

---

About the couple FIXME:

1. https://github.com/aboutcode-org/scancode.io/pull/1886/files#diff-a1d9a02b6d47c297535484fe73ff6436f3ba38f7b3de938b41aa3b43bde7158bR210

This is a data issue. ScanCode.io loads what is provided in the SBOM, see https://github.com/oss-review-toolkit/ort/blob/e40ada3cda7ff156607e88499540e82741b3aaee/plugins/reporters/cyclonedx/src/funTest/resources/cyclonedx-reporter-expected-result.json#L365-L386

Nothing to fix here imo.

2. https://github.com/aboutcode-org/scancode.io/pull/1886/files#diff-a1d9a02b6d47c297535484fe73ff6436f3ba38f7b3de938b41aa3b43bde7158bR341-R346
   Both values look correct in the ScanCode.io imported results. The SBOM has 380 components and the full dependencies tree looks correct too.