Centralising sbom dependency data, plus adding versions to sboms

[adamfarley]

This is to centralise the jar versions and shas to simplify future updates, and to enable a user to easily set their own values.

This also adds cyclonedx dependency version strings to sboms.

[github-actions]

A block has been put on this Pull Request as this repository is temporarily under a code freeze due to an ongoing release cycle.

If this pull request needs to be merged during the release cycle then please comment /merge and a PMC member will be able to remove the block.

If the code freeze is over you can remove this block by commenting /thaw.

[adamfarley]

Linked to #3593

[adamfarley]

Tested here: https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk21u/job/jdk21u-linux-x64-temurin/153/

Passed. SBOM output:

        {
          "name" : "CycloneDX jar versions",
          "properties" : [
            {
              "name" : "commons-codec.jar",
              "value" : "1.15"
            },
            {
              "name" : "commons-io.jar",
              "value" : "2.11.0"
            },
            {
              "name" : "cyclonedx-core-java.jar",
              "value" : "8.0.3"
            },
            {
              "name" : "github-package-url.jar",
              "value" : "1.4.1"
            },
            {
              "name" : "jackson-annotations.jar",
              "value" : "2.14.2"
            },
            {
              "name" : "jackson-core.jar",
              "value" : "2.14.2"
            },
            {
              "name" : "jackson-databind.jar",
              "value" : "2.14.2"
            },
            {
              "name" : "jackson-dataformat-xml.jar",
              "value" : "2.14.2"
            },
            {
              "name" : "json-schema.jar",
              "value" : "1.0.77"
            }
          ],
          "type" : "framework"
        }

[andrew-m-leonard]

lgtm

[adamfarley]

The license check seems not to apply in this case (as all the failing files contain externally-sourced data such as SHAs, version strings, and jar names), so I've raised a PR to remove the requirement here:

#3772

No freeze on master branch.