Generate serial numbers deterministically (#420)

[vy]

This PR implements two changes:

1. Serial numbers are generated deterministically by deriving a UUID from groupId, artifactId, and version namespace
2. Serial numbers are included by default even for reproducible builds (which is disabled now in master due to non-deterministic nature of the serial number generation scheme there)

[ppkarwasz]

LGTM

[hboutemy]

nice work: I think we should add more data to the seed on the configuration used of cyclonedx-maven-plugin that affect the result, like the scopes configuration and the goal used
that way, we avoid having different configuration give different output with the same uuid

[vy]

@hboutemy, thanks so much for the prompt review! 🙇

Making seed's entropy reflect the Maven coordinate (composed of groupId, artifactId, and version) was a deliberate decision. AFAIU, there can only be one SBOM deployed to a particular Maven coordinate. Hence, capturing the Maven coordinate uniqueness in the generated serial number sounds logical to me. If the user is expecting a different serial number just because they happen to change, say, the order of plugins, output timestamp, package type, etc., they should not, just like they should not expect Maven coordinate to change too.

Is there a particular real world situation in your mind? Could you share a concrete use case where deriving the serial number only from the Maven coordinate will cause confusion/trouble?

[vy]

(CI fails since json-unit-assertj-3.2.2 is not Java 8 compatible. I will address this.)

[hboutemy]

PR provided vy#1