Secure Software Supply Chain Aspects

[afrittoli]

Follow up for #70

We should include an SBOM field to artifact events.

The first consumer of this field will be guac.sh.

[e-backmark-ericsson]

@afrittoli , what do you see should be added from secure supply chain aspects in CDEvents that is not yet there? Should we synch up with someone in OpenSSF to sort needs out?