custom sbom generation script

[heubeck]

config setting for bypassing cdxgen with a custom sbom creation script

[heubeck]

no intention to provide this feature, until there's a concrete demand.
keeping the idea and hence the issue open.