GET /actuator              -> links: self, sbom, sbom-id, health, health-path
GET /actuator/sbom         -> 200 {"ids":["application"]}
GET /actuator/sbom/application -> 200, content-type application/vnd.cyclonedx+json
  bomFormat CycloneDX, specVersion 1.6, components 49
same document as the file the build wrote: true
GET /actuator/sbom/nope    -> 404