Generate SBOM for NuGet packages

[sophiewigmore]

To implement Paketo RFC0038, this buildpack will need to generate an SBOM for the packages that get installed via dotnet publish and store it in a CNB lifecycle-accessible file as outlined in the RFC.

Blocked

This issue is blocked on having some mechanism to actually generate an SBOM for a .NET Core app. Currently, we use the Syft library in packit in order to generate SBOMs for other buildpack language families, such as Node.js.

This issue is blocked on paketo-buildpacks/dotnet-core#712

anchore/syft#373 exists, which may be the most straightforward and logical place to approach solving this issue, so we can then consume the release and generate the BOM in a similar fashion to our other buildpacks. A reasonable starting place could be to consider how Syft could gather package info from the *.deps.json file after the publish step, or the obj/project.assets.json file.

[thitch97]

Relevant PR: anchore/syft#951

[ForestEckhardt]

This works makes more sense to happen in the dotnet-execute buildpack as it sees all types of users provided projects such as FDDs and FDEs as well as SCDs not just source builds. I have opened an issue in the dotnet-execute repository to track this work.

paketo-buildpacks/dotnet-execute#317