Generate a CycloneDX SBOM for every released Maven artifact

Users and scanners need to know which third-party components a released XWiki artifact contains, without reverse-engineering it (e.g. to answer "is XWiki X.Y affected by CVE-Z?"). The CRA also requires manufacturers of products with digital elements to have an SBOM, so companies building on XWiki need one from us.

Proposal

Configure the cyclonedx-maven-plugin (makeBom) in the release profile of the Commons top level POM, so that every deployed artifact of Commons, Rendering, Platform and contrib extensions gets a CycloneDX JSON SBOM attached with the cyclonedx classifier:

• includeProvidedScope set to false, since provided dependencies are supplied by the servlet container, not by us.
• projectType set to application for distributions (e.g. the WAR), library otherwise.
• The supplier is the XWiki open source project, and the license uses its SPDX id (LGPL-2.1-or-later).
• The timestamp comes from project.build.outputTimestamp so that builds stay reproducible.
• A property allows a project to skip it.

Normal builds are not impacted. The TestRelease CI job, which builds with performRelease=true, exercises it on every build.

Design: https://design.xwiki.org/xwiki/bin/view/Proposal/SBOMPerRelease
Forum: https://forum.xwiki.org/t/publishing-an-sbom-with-every-xwiki-release/18996