Generate an SBOM

[pnoltes]

Update the CI to generate a Software Bill of Materials (SBOM) as part of the ASF Celix CI pipeline.

Notes / Open questions

• We currently do not commit conan.lock to SCM
  • Should the lockfile be generated in CI and used for SBOM generation?
• Which SBOM gen technology to use (cdxgen, sbomify, etc)?

It is ok to provide a proposal in a pull request.
Contributions, tooling suggestions, and prior experience are very welcome.

Expected outcome

• CI job that generates an SBOM
• SBOM published as a CI artifact
• Short documentation describing: how the SBOM is generates

[PengZheng]

Should the lockfile be generated in CI and used for SBOM generation?

Yes, and Conan 2.x can generate SBOM for us, which saves us from the second question:

Which SBOM gen technology to use (cdxgen, sbomify, etc)?