Embed an SBOM of the bundled npm packages in XWiki webjars

The npm packages that our webjars bundle (compiled by Vite from our pnpm workspace) don't appear in any Maven dependency, so they are missing from the SBOMs of XWiki and vulnerability scanners can't report advisories affecting them.

Proposal

During the release build of each XWiki-built webjar, run pnpm sbom --sbom-format cyclonedx --prod --filter <package> (native since pnpm 11, which we use) and package the result in the webjar under META-INF/sbom/. It's based on the pnpm lockfile and lists only the production dependencies, i.e. what ends up in the bundle.

The Commons SBOM mojo then folds it into the SBOM of every artifact depending on the webjar, up to the WAR.

Design: https://design.xwiki.org/xwiki/bin/view/Proposal/SBOMPerRelease
Forum: https://forum.xwiki.org/t/publishing-an-sbom-with-every-xwiki-release/18996