SBOM accessory that is replicated over from another registry is not deleted after triggering SBOM manual generation

[zyyw]

How to reproduce?

1. deploy two harbor instances: harbor1 and harbor2
2. push image1 to harbor1; generate SBOM for image1
3. create a push-based replication from harbor1 to harbor2 to replicate image1 (located on harbor1) and its SBOM accessory to harbor2
4. we can see that the image1 and its SBOM accessory are replicated to harbor2 (image1, sbom1 harbor1 -> image2, sbom2 harbor2). However, if we trigger a SBOM generate manually for the image2 (which is the image1 on harbor1 replicated to harbor2), we can see that in addition to sbom2 being associated to image2, a new SBOM (sbom3) is associated to image2. So there are in total of 2 SBOM accessories (sbom2 & sbom3) associated to image2. Should sbom2 be replace by sbom3?

[xuelichao]

According to our discussion in design stage, Ui will Use the first item in the accessories list. i think the order of item in the list returned fro the backend does not correct. we should always put the latest one in the first item of the list.