Create Software Bill of Goods (SBOM)

[gwright99]

The Wave service has reported clients are looking for SBOMs to be provided alongside the generated images.

Since we now use trivy to scan the repository, we should consider doing the same to better support installations into environments with more rigorous security protocols.

[gwright99]

A few ideas:

• Software Package Data Exchange (SPDX and SPDX Lite), an ISO standard hosted by the Linux Foundation, which outlines the components, licenses, and copyrights associated with a software package.
• CycloneDX, an open source, lightweight SBOM standard, which is used in application security and supply chain analysis and originated from the Open Web Application Security Project (OWASP).