Add sbom generation tooling (#2232)

[Lukasz-Juranek]

This PR adds basic sbom bazel rules for details see

https://github.com/Lukasz-Juranek/score-tooling/blob/01e9dd78913f28e8de71a0e35e9fc54d23a783e0/sbom/SBOM_Readme.md

https://github.com/Lukasz-Juranek/score-tooling/blob/01e9dd78913f28e8de71a0e35e9fc54d23a783e0/sbom/SBOM_Implementation_Approach_SCORE.md

Here are generated SBOMs for reference_integration targets:
sbom_kyron.cdx.json
sbom_kyron.spdx.json
sbom_orch_per.cdx.json
sbom_orch_per.spdx.json

Here is SBOM target definition: eclipse-score/reference_integration#83
Here is example definition of SBOM data: eclipse-score/baselibs#93

This is not full solution but rather sth to begin with.
Happy to discuss this in details.

[AlexanderLanin]

@Lukasz-Juranek this looks interesting! Can you describe a little why we need custom code? No native bazel support etc.

[Lukasz-Juranek]

Hi right now i'm not aware of any out of box support for bazel that would really cover all c++ imports and rust code.

But IMO tooling itself is not important that much, this can be replaced later on with anything

What is important is to start getting the SBOM data for 3rd party dependencies in any meaningful format when there is not much deps, and to build in SCORE developers this behavior that when you import some stuff to your project you think about SBOM.

If SBOM data will be available then you can do conversion to some mature solution.