Add SBOM generation capability

[marcprux]

This PR adds the skip sbom command, which the ability to generate an SPDX sbom package summary with skip sbom create and validate it with skip sbom verify