sbom: use the bare cyclonedx plugin declaration that starter-parent configures; outputs unchanged

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf

sbom/README.md

@@ -25,7 +25,7 @@ java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json
 
 | File | What it does |
 |---|---|
-| `pom.xml` | Boot parent, `cyclonedx-maven-plugin` writing `META-INF/sbom/application.cdx.json`, and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
+| `pom.xml` | Boot parent, a bare `cyclonedx-maven-plugin` declaration (the parent supplies version, goal and output path, so the build writes `META-INF/sbom/application.cdx.json`), and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
 | `src/main/resources/application.properties` | exposes the `sbom` Actuator endpoint |
 | `src/test/.../ActuatorSbomTest.java` | starts the app, calls `/actuator/sbom`, writes `output/05` |
 | `src/test/.../DefaultExposureTest.java` | the endpoint with default exposure, writes `output/06` |

sbom/pom.xml

@@ -60,21 +60,6 @@
       <plugin>
         <groupId>org.cyclonedx</groupId>
         <artifactId>cyclonedx-maven-plugin</artifactId>
-        <version>2.9.3</version>
-        <executions>
-          <execution>
-            <phase>generate-resources</phase>
-            <goals>
-              <goal>makeAggregateBom</goal>
-            </goals>
-          </execution>
-        </executions>
-        <configuration>
-          <outputFormat>json</outputFormat>
-          <outputName>application.cdx</outputName>
-          <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
-          <projectType>application</projectType>
-        </configuration>
       </plugin>
     </plugins>
   </build>