Fold bundled npm packages and third-party webjars into the artifact SBOMs

The SBOM generated by the cyclonedx-maven-plugin only lists Maven dependencies. It misses:

• the npm packages bundled (e.g. by Vite) inside our webjars, which are invisible to Maven;
• the npm identity of third-party webjars, which only appear as pkg:maven/org.webjars/..., so vulnerability scanners don't match them against npm advisories (jQuery, Bootstrap...).

Proposal

Add a new mojo in a Commons tool Maven plugin, run after makeBom in the release profile, that:

• folds the Embedded SBOMs found in META-INF/sbom/ of the module and of its resolved dependency JARs into the module's SBOM, recording each bundled component as contained in its JAR;
• maps third-party webjars to their pkg:npm purl, using the webjar's own metadata plus a curated mapping table, and warns for unmapped webjars;
• gives every component a stable purl and a unique, deterministic bom-ref (containing JAR purl + npm purl), to be ready for VEX later.
• sets the SBOM metadata.supplier and metadata.manufacturer to the XWiki project, which the cyclonedx-maven-plugin cannot do (it only sets publisher from the POM <organization>), as expected by the CRA guidance (BSI TR-03183-2).

Whether the bundled components are nested under their JAR component or listed flat with a containment relationship is decided by a prototype checking how scanners (e.g. Grype, Dependency-Track) read each layout.

Design: https://design.xwiki.org/xwiki/bin/view/Proposal/SBOMPerRelease
Forum: https://forum.xwiki.org/t/publishing-an-sbom-with-every-xwiki-release/18996