Generate and output sbom in GHA

[AndreKurait]

Description

Use Syft action to generate and output sbom alongside published artifacts.
Added license identifier to created jars.

• Category: Enhancement
• Why these changes are required? Users expect software boms with artifacts
• What is the old behavior before changes and new behavior after changes?

Issues Resolved

Is this a backport? If so, please add backport PR # and/or commits #

Testing

Tested with GHA, see https://github.com/opensearch-project/opensearch-migrations/actions/runs/11713035148?pr=1121

Check List

• New functionality includes testing
  • All tests pass, including unit test, integration test and doctest
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.60%. Comparing base (c189ced) to head (acc368a).
Report is 5 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #1121      +/-   ##
============================================
+ Coverage     80.51%   80.60%   +0.09%     
- Complexity     2871     2914      +43     
============================================
  Files           393      393              
  Lines         14554    14630      +76     
  Branches       1000     1007       +7     
============================================
+ Hits          11718    11793      +75     
+ Misses         2229     2228       -1     
- Partials        607      609       +2     

Flag	Coverage Δ
gradle-test	78.72% <ø> (+0.12%)	⬆️
python-test	90.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[peternied]

How did you come to pick this GitHub action, looks like it hasn't been fully released yet?

[AndreKurait]

Syft is the industry standard sbom tool that this is running, and is made by it's creators. This was first released in 2021 and has had regular releases since.

If you would prefer, i can manually get the syft binary and run it that way

[AndreKurait]

https://github.com/anchore/sbom-action

[peternied]

Lets use v0.X.Y to lock to a specific rather than just v0 - dependabot can manage these updates.

[AndreKurait]

Updated