Investigate what metadata can be retrieved for yarn-install modules

[sophiewigmore]

As a part of our BOM work outlined in this RFC, we would like to support some type of BOM metadata for modules provided by buildpacks like yarn-install.

We should investigate the extent of data that can be extracted around the following for the modules provided by this buildpack:

• All of the the other information (SHA, URI, etc for each module)
• License information
• CPEs

Acceptance
The outcome of this issue should be more issues that outline the work needed to implement viable metadata as a result of this investigation.

[sophiewigmore]

See this comment on the NPM Install version of this issue for solution here. The TL,DR is that we will be using the https://github.com/CycloneDX/cyclonedx-node-module tool for both NPM and Yarn.