Add OmniBOR artifact ID support for versions

[AgentGoose32]

Summary

• add an omnibor_artifact_id field for package versions, indexed for lookup
• generate OmniBOR Artifact IDs using the SHA-256 GitOID blob construction when version integrity and artifact length metadata are available
• expose omnibor_artifact_id in version API responses
• allow filtering package versions by OmniBOR Artifact ID
• add model and API coverage for ID generation and lookup

Refs #1205

Validation

• ruby -c app/models/version.rb
• ruby -c app/controllers/api/v1/versions_controller.rb
• ruby -c db/migrate/20260429051000_add_omnibor_artifact_id_to_versions.rb
• ruby -c test/models/version_test.rb
• ruby -c test/controllers/api/v1/versions_controller_test.rb
• git diff --check

Full Rails test execution is blocked locally because this repo lockfile requires Bundler 4.0.10 while the system Ruby/Bundler cannot satisfy it.