Add sbom module: Spring Boot 4.2.0-RC1 tools jar-mode sbom command, CycloneDX in the jar, Actuator endpoint, licence check and OSV scan

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf

sbom/scripts/commands-by-version.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Lists the command classes inside spring-boot-jarmode-tools for 4.1.2 and 4.2.0-RC1, straight from Maven Central.
+set -uo pipefail
+cd "$(dirname "$0")/.."
+for v in 4.1.2 4.2.0-RC1; do
+  f=/tmp/jarmode-tools-$v.jar
+  for try in 1 2 3 4 5; do
+    curl -s -o "$f" "https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-jarmode-tools/$v/spring-boot-jarmode-tools-$v.jar"
+    unzip -tq "$f" >/dev/null 2>&1 && break
+    sleep 5
+  done
+  echo "$v: $(unzip -Z1 "$f" | grep 'Command.class' | grep -v '\$' | sed 's#.*/##; s#.class##' | sort | tr '\n' ' ')"
+done