Add a feature for embedding SBOMs

[jerboaa]

With the new option --enable-sbom=embed:path-classpath-resource, one can embed the specified SBOM in the produced native image. The resource is looked up on the Quarkus Feature's classpath.

The SBOM is generated by Quarkus (see quarkusio/quarkus#53552). All this patch does is to embed it into the native image following the specs in https://www.graalvm.org/jdk25/security-guide/native-image/sbom/#native-image-utils-tool with respect to sbom and sbom_length symbols.

Thoughts?

[zakkak]

Since the implementation is a feature, more so a Quarkus specific feature, I believe it would be better implemented in Quarkus instead.

Drawbacks:

1. The main issue with that approach would be the dependency on internal GraalVM APIs like CGlobalData, meaning that the feature should be implemented using gizmo (the same way io.quarkus.runner.Feature is generated) to avoid compilation issues.
2. If the internal APIs change, the feature would also break requiring augmenting it with GraalVM version detection to adapt accordingly.

Advantages:

1. We don't deviate from upstream.
2. We don't introduce a new option or an option clashing with an Oracle GraalVM option without providing the same functionality.
3. We don't implement a Quarkus specific feature that is not expected to get upstream.

WDYT?

[jerboaa]

I tend to agree. Those cyclic dependencies are pretty nasty. The feature also needs to add native image generator specific bits to the embedded sbom eventually. It's not clear to me to how we should approach that chicken/egg problem: SBOM is generated by quarkus, embedded in jars. On native compilation the exact native image generator version needs to get embedded as well. We only have the native image version available in the NativeImageBuildStep that depends on the jar generation step. If you have some cycles to move this forward, I'd appreciate a hand. Otherwise, I'd likely throw some AI tool at this gizmo transformation problem.

[zakkak]

If you have some cycles to move this forward, I'd appreciate a hand.

Sure, I will prepare a Quarkus patch and assign you as a reviewer.

[jerboaa]

If you have some cycles to move this forward, I'd appreciate a hand.

Sure, I will prepare a Quarkus patch and assign you as a reviewer.

Makes sense. It needs to go in together with quarkusio/quarkus#53861

[jerboaa]

Closing for now.

[zakkak]

Sure, I will prepare a Quarkus patch and assign you as a reviewer.

quarkusio/quarkus#53923