feat: SBOM output format

[JamieMagee]

This PR adds support for a new --ManifestFileFormat flag which accepts:

• ComponentDetection
• CycloneDx
• SPDX

Currently ComponentDetection (default) and CycloneDx are implemented, with plans to implement SPDX once the proof-of-concept is accepted.

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[JamieMagee]

@coderpatros does the CycloneDx mapper contain enough information? Is there anything I am missing?

[coderpatros]

This looks pretty good to me. Although there are a couple of spots that could include more information.

[coderpatros]

@JamieMagee I can't remember if I've mentioned this to you before. But we also have a CycloneDX.Spdx NuGet package. It has SPDX data models and a JSON serializer implemented. Doco is here https://cyclonedx.github.io/cyclonedx-dotnet-library/api/CycloneDX.Spdx.Models.v2_2.html

[JamieMagee]

Build failures are related to dotnet/runtime#61602

[sailro]

@JamieMagee I'm really interested by this PR. Now that you fully switched to .NET 6, rebasing this work on top of main should solve previous build failures related to Json/.NET Core 3.x. What do you think ?
Thanks!

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂

[FernandoRojo]

Closing due to low priority / large conflicts, We have an open issue tracking this effort here: #42 and we will revisit the work when resolving that issue.