feat(ci/SEC-1085): slsa sbom and provenance generation

[saisatishkarra]

Summary

• SBOM is produced by detecting any supported packages within the ${{github.repository}}. Ex: yarn.lock
• No Distro specific packages / deps are tracked in the SBOM
• Provenance is published using npm due to issue #5430

TODO

• identify any drift for missing packages / libraries in the SBOM:
  • package managers
  • source binaries
  • yarn global cache
  • node-gyp
  • libcurl
• Refactor to storing build tooling in a directory relative to ${{github.repository}} for Syft catalogers to avoid parsing complete filesystem ""

References

• Refer https://github.com/anchore/syft/tree/main/syft/pkg/cataloger to understand how each cataloger parses / looks up for dependencies.

[saisatishkarra]

@jackkav / @filfreire I have been able to fix mac-os build failure issue and produce an initial sbom as discussed. Please review and we can iterate to optimize it.

I haven't made the switch to use npm instead of yarn