Add SBOM generated with syft to build/

[alexhulbert]

This is a rewrite of PR #188. It uses Syft (which gets reproducibly packaged into the nix flake) to generate the SBOM directly from the dpkg metadata. It also improves upon the previous PR by automatically including any packages compiled by make_git_package or build_rust_package into the SBOM, as well as any packages installed manually through $PACKAGEDIR

[alexhulbert]

This PR improves on the previous version by doing the following:

• Scans image filesystem for dependencies and adds them to SBOM, including dependency edge graph (only ones that are actually used thru cargo auditable)
• Finds deps in both locally built software and debian-supplied binaries
• Records packages compiled from source into SBOM along with information about git source, including pkgs that aren't installed via deb file
• Adds dependency graph for go/rust/deb pkg/etc
• Tracks git commit, version, etc of packages built from git ource
• Scans deb packages for copyright/publisher/maintainer information and includes in SBOM
• Adds source package and installed size metadats from deb pkgs where available
• Uses idiomatic pkg:deb/pkg:cargo/pkg:golang/pkg:generic PURLs
• Automatically determines which volatile packages in $PACKAGEDIR are installed without needing to specify in an env variable
• Supports easily switching to different SBOM formats like SPDX with a single line change if we ever want to do that
• Adds support for DM-Verity-based split rootfs images

I removed the "incomplete" tag on the generated SBOM, since at least for Flashbox, the SBOM now contains all software components for the Flashbox images