support Reproducible SBOM: drop UUID and timestamp when RB mode enabled

[hboutemy]

fixes #226

when Maven Reproducible Builds mode is detected (with project.build.outputTimestamp), non-reproducible UUID and timestamp are just removed from SBOM

[aalmiray]

Why is the timestamp removed when a reproducible build is requested? Wouldn‘t it make sense to use the supplied timestamp?

[hboutemy]

because SBOM defines the semantics of timestamp as the time of the build
instead of starting to discuss what is the semantics of project.build.outputTimestamp (which by experience can get very long and non-productive, just for timestamp in jar that nobody cared until now), just not putting a timestamp will be clearer to show that "something is happening" (and this PR added a property to show that the something is Reproducible Builds mode)

[aalmiray]

Understood. Will propose the same changes to the Gradle plugin.

[hboutemy]

notice that reproducible UUIDs have been implemented in #425