Add sbom module: Spring Boot 4.2.0-RC1 tools jar-mode sbom command, CycloneDX in the jar, Actuator endpoint, licence check and OSV scan

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf

sbom/output/08-licences.txt

@@ -0,0 +1,17 @@
+licence entries (a component with two licences counts once under each):
+  Apache-2.0                           43
+  EPL-2.0                              3
+  LGPL-2.1-only                        2
+  MIT                                  2
+  GPL-2.0-with-classpath-exception     1
+  CC0-1.0                              1
+  BSD-2-Clause                         1
+
+naive rule 'fail on any GPL or LGPL entry' flags 3: logback-classic, logback-core, jakarta.annotation-api
+rule 'fail only when every listed licence is GPL or LGPL' flags 0
+no licence listed: none
+dual-licensed components (more than one entry):
+  logback-classic: EPL-2.0 / LGPL-2.1-only
+  logback-core: EPL-2.0 / LGPL-2.1-only
+  jakarta.annotation-api: EPL-2.0 / GPL-2.0-with-classpath-exception
+  HdrHistogram: CC0-1.0 / BSD-2-Clause