SBOM support

[andrew]

• upload an sbom
  • text
  • url
  • file upload
• normalize the SBOM from all of the different formats (SPDX, CyclonDX, syft, github etc)
• store normalized SBOM in database
• display SBOM artifacts
• enrich artifact list with projects that are on open collective

Future:

• enrich artifacts list with data for all packages

[andrew]

Will likely need to extract the packages out into a seperate table as the current approach to indexing on packageurl won't scale as the field won't fit into an index for repos with many packages like https://github.com/babel/babel