Evaluate generation of aboms for ci/cd dependency analysis

[dave2wave]

I saw a note about Generating aboms on the OpenSSF slack. This tool may be a useful analysis gathering step in an atom analysis workflow.

Let's discuss.

[raboof]

While I find the whole 'everyone wants to be a BOM' thing a bit cringey, this might potentially be a neat tool to build #606 on top of.