fix(sbom): warn about missing stageDependencies for file-based packages

[reyreavman]

Summary

With a file-based packages directive (go-mod, python-pip, rust-cargo, …), changing the spec/lock file contents (e.g. go.mod) does not rebuild the packages stage unless the files are listed in git.stageDependencies.packages: the installed dependencies silently go stale while the SBOM keeps reporting the updated files. werf now emits a global warning when such a directive is used without stageDependencies.packages in any git mapping.

What

• An image with a file-based packages directive and git mappings, none of which declares stageDependencies.packages, produces a once-per-image global warning (repeated in the end-of-run WARNINGS summary) telling the user to declare the spec/lock paths.
• No warning for os-pm (its package list lives in werf.yaml and already feeds the stage digest), for images without git mappings, or when any git mapping declares stageDependencies.packages.
• New e2e coverage: a go-mod fixture where only go.mod changes between states (werf.yaml identical) asserts the packages stage is rebuilt (Building stage app/packages) and the SBOM picks up the new module; the unchanged rebuild asserts the stage stays cached.
• UNVERIFIED: the new e2e test has not completed a local run (the run needs a configured test registry and a git config without tag.gpgsign); settle it with task test:e2e paths="./test/e2e/sbom/..." labelFilter="stage-deps".
• Docs (docs/pages_en, docs/pages_ru, stapel instructions): file-based packages types now document the stageDependencies.packages requirement with an example; os-pm is documented as not needing it.
• Existing digest behavior does NOT change: no automatic injection of spec/lock paths into stage dependencies, so no cache invalidation on upgrade.

Why

The packages stage digest is built from the generated install command plus the stageDependencies.packages checksum. For file-based ecosystems the command contains only paths (cd "/app" && go mod download), so file content changes leave the digest intact and go mod download/npm ci/cargo fetch is never re-run — while the SBOM cataloger reads the updated spec/lock from the image (delivered by the git patch) and reports packages that were never installed. A lying SBOM is a security artifact defect, not just a stale cache. Automatic injection of spec/lock into stage dependencies was rejected: workdir is a container path that cannot be reliably mapped back to git-repo paths (multiple git mappings, files produced by earlier stages or the base image), it would deviate from the explicit stageDependencies model of install/setup stages, and it would invalidate caches for every existing user of file-based packages.