SPDX Generation

[augelu-tng]

The main goal of the sbom.py script is to output an sbom.spdx.json file.
The SPDX standard provides a set of classes that can be composed in a graph structure.
The specific structure used in this project is defined in #58.