[SBOM] Capture all tools with their version / digest that are downloaded during a build

[netomi]

The sbom should capture all external tools with their version / digests that are downloaded during the build. This mainly concerns the cyclonedx tools / dependencies.

Ideally, in the long run, there should not be a need to download these tools externally for each build, but they could be hosted in a tool repository that is checked out using a defined commit during the build to avoid relying on external services as much as possible.

[sxa]

Noting that CycloneDX is pulled from the build.getDependency job:

temurin-build/cyclonedx-lib/build.xml

Line 47 in 08ef952

srcurl="https://ci.adoptium.net/view/all/job/build.getDependency/lastSuccessfulBuild/artifact/sbom_dependencies/cyclonedx-core-java.jar"

While the checksums are stored in the ant build file, we can generate those for the artifacts on the file system at SBoM creation time and incorporate those.

[sxa]

PR for the CycloneDX now merged, build.getDependencies re-run to pick up the new version, so #3538 can proceed

[sxa]

CycloneDX SHAs are in the SBoM so this is complete as far as I'm aware. Closing.