SPDX support for SBOM

[TristanCacqueray]

Summary

Support generating SPDX manifests and check them with the advisories database?

[frasertweedale]

Ping @MangoIV . IIRC you already started the work? We can use this ticket to track the effort and discuss anything that needs discussing - especially if there is something SRT can help with.

[blackheaven]

I think it's basically done https://github.com/MangoIV/cabal-audit/blob/main/src/Security/Advisories/SBom/CycloneDX.hs

[frasertweedale]

If the cabal-audit SBOM generation is working well, let's write a guide and promote it.