Publish an SBOM of the XWiki WAR with each release

Users want to check whether a given XWiki version is affected by a CVE without reverse-engineering the WAR. Scanning the WAR is not enough: running Syft on an 18.9 WAR finds 836 Maven components but 0 npm ones, no XARs and no dependency graph.

Proposal

Publish, with each release, the SBOM of the XWiki WAR describing the running product:

• what the WAR contains, including the npm packages bundled in webjars and the npm identity of third-party webjars;
• the XARs installed by the flavor on first start;
• but not what the servlet container provides.

Also:

• Add a check, run by the TestRelease CI job, verifying that the WAR SBOM contains the expected pkg:npm purls, so that a regression in the JavaScript part is caught.
• Link the WAR SBOM from the download page and from the release notes.

Design: https://design.xwiki.org/xwiki/bin/view/Proposal/SBOMPerRelease
Forum: https://forum.xwiki.org/t/publishing-an-sbom-with-every-xwiki-release/18996