Generate SBOM from SIF Image

[tri-adam]

To support users of SingularityCE who are investing in their software supply chain security, we should look at adding support for users to generate a software bill of materials (SBOM) from a given SIF image, and (perhaps optionally) embed the SBOM itself within a SIF image.

We should look at integrating with an existing, open source tool to do the actual SBOM generation. We are already using Goreleaser to generate our releases, which supports SBOM generation and uses Anchore Syft under the hood (ref). This would seem like a compelling place to start.

This support could be bundled into singularity, siftool, and/or syft itself. @luhring, would there be any appetite to add SIF support directly within Syft? Happy to assist with effort to make that happen, if it makes sense from a user perspective.