Follow-up from "refactor(sbom): upload sbom in deploy job to support environment url as version"

The following discussion from !169 (merged) should be addressed:

• @maw started a discussion:

  ok, i see what the problem might be

  the needs can contain string or object where it defines whether artifacts are needed

  the deduplication should respect when a job defines artifacts: true and should prefer that one over the other

  its probably the reason why you moved needsFromStages above the other arrays.

  i suggest that we merge and i'll fix that afterwards