feat: generate spdx sbom and add Makefile target for sbom generation

[jim-wang-intel]

Closes: #4173

Signed-off-by: Jim Wang yutsung.jim.wang@intel.com

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/main/.github/Contributing.md

PR Checklist

Please check if your PR fulfills the following requirements:

• [x ] I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
• I am not introducing a new dependency (add notes below if you are)
• I have added unit tests for the new feature or bug fix (if not, why?)
• [x ] I have fully tested (add details below) this the new feature or bug fix (if not, why?)
• I have opened a PR for the related docs change (if not, why?)

Testing Instructions

• git clone this branch
• run make sbom and it should run successfully and produce sbom under the directory sbom\

New Dependency Instructions (If applicable)

spdx docker container used for generating spdx-sbom: https://github.com/opensbom-generator/spdx-sbom-generator

[bnevis-i]

Pretty cool! @lenny-intel do you think we should be checking in the resulting SBOM?

[ernestojeda]

See comments

[jim-wang-intel]

Pretty cool! @lenny-intel do you think we should be checking in the resulting SBOM?

Thanks and good question, @bnevis-i ; depending on what is the satisfying requirement for complying that description about In order to help companies comply with US Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021). i.e if the artifacts are required in github repo then the answer is yes or just having a way to generate SBOM in spdx format.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[bnevis-i]

LGTM