Generate SBOM

[zooba]

The creation of SBOMs (see https://spdx.dev) is becoming a requirement for anyone who deals with the US government, which likely means it will spread throughout the industry.

Add an option to generate/include an SBOM in built packages.