fix(libjpeg-turbo): wire SBOM manifest and correct CPE

[fhrbata]

Checklist

• Component contains License
• Component contains README.md
• Component contains idf_component.yml file with url field defined
• Component was added to upload job
• CI passing

Note: this is a fix to the existing libjpeg-turbo component, not a new component.

Change description

libjpeg-turbo/sbom_libjpeg.yml was never referenced from libjpeg-turbo/idf_component.yml. esp-idf-sbom only treats a file as a manifest if it is wired through one of its recognized entry points (sbom.yml, idf_component.yml, .gitmodules), so the unreferenced sbom_libjpeg.yml was invisible to it. As a result libjpeg-turbo was excluded from SBOM generation and CVE scanning, and its manifest was never validated by the test_sbom CI job.

This PR:

• Wires in the manifest — adds the sbom: section to idf_component.yml (matching every other component here), so sbom_libjpeg.yml is discovered.
• Fixes the CPE, which was both:
  • malformed — the CPE-spec-version field read 3.1.1 instead of 2.3, so the value was not a well-formed CPE 2.3 binding and never matched NVD; and
  • pointing at the wrong product — libjpeg:libjpeg is IJG libjpeg, not libjpeg-turbo. Replaced with the two products NVD assigns to libjpeg-turbo CVEs: libjpeg-turbo:libjpeg-turbo and d.r.commander:libjpeg-turbo (both, since NVD splits libjpeg-turbo CVEs across the two vendors).
• Bumps the component revision to 3.1.1~2.

With the manifest wired in, esp-idf-sbom manifest validate discovers and validates it (exit 0).