Publish SBOM

**Describe the feature:**

Publish a _software bill of materials_ (SBOM) for JanusGraph.



**Describe a specific use case for the feature:**

This enables users to quickly inspect which packages they are getting together with JanusGraph and in which specific version. That information can for example be used to scan for known vulnerabilities (like Log4Shell) or to check whether all dependencies meet their guidelines / are compliant with relevant regulations.



There seem to be 2 different major formats for SBOMs:



- SPDX from the Linux Foundation

- CycloneDX from the OWASP foundation



I don't have a strong preference, but from a quick search it seems that CycloneDX is more popular, especially among OSS projects. Sonatype also [mostly argues](https://blog.sonatype.com/comparing-sbom-standards-spdx-vs.-cyclonedx-vs.-swid) in favor of CycloneDX.

[]