Implement Paketo RFC 0038: CycloneDX + Syft SBOM

[sophiewigmore]

To implement Paketo RFC0038, this buildpack (and the implementation buildpacks inside) will need to move from storing SBOM information in layer metadata to storing it in files that the CNB lifecycle can manipulate during the build. The RFC outlines what these files are and what they should contain.

This issue serves as a meta-issue for work required to complete this work for the .NET Core language family. This will require:

This is most labor-intensive part of this track of work, so we should kick off the work for these issues first:

• Investigate: SBOM creation for all app types #650
• Possible contribution to Syft (RE: Investigate: SBOM creation for all app types #650)

---

Dependent on outcome from #650:

• Add support for layer style SBOM dotnet-execute#317

---

• Generate SBOM for .NET Core Runtime dotnet-core-runtime#285
• Generate SBOM for .NET Core SDK dotnet-core-sdk#303
• Generate SBOM for ASPNet dotnet-core-aspnet#288
• Generate SBOM for ICU icu#270