Implement RFC0038 Amendment: Reproducible CycloneDX SBOMs

[fg-j]

Describe the Enhancement

Now that paketo-buildpacks/rfcs#220 has been approved and merged, we should make changes to the CycloneDX SBOM implementation so that CycloneDX JSON v1.3 and v1.4 SBOMs generated by Paketo buildpacks are reproducible. This means omitting the metadata.timestamp and serialNumber fields from the SBOM output.

Both CycloneDX 1.3 and 1.4 SBOMs should be reproducible.

Possible Solution

• Modify the sbom.FormattedReader.Read() function to edit the CycloneDX JSON after it's generated and/or
• Modify the cyclonedx13 sbom.Format.Encode() implementation so that it doesn't include the non-reproducible fields in the generated SBOM struct.

Motivation

If SBOMs are not reproducible, they make buildpack-built images non-reproducible. Buildpack users and buildpack authors using packit shouldn't compromise build reproducibility just to get image SBOMs.