Follow up of #14241

• Declares Erlang Dependency
• Declares elixir applications (required for purl to identify in case of elixir vulnerabilities)
• Switches back to the official ORT action repo
• Will pass the NTIA SBoM checker
  • Does not yet pass since Add Elixir Language Trademarks Policy aboutcode-org/scancode-toolkit#4131 is not yet done
• The CI will inject the version info into the ORT config & SPDX file at runtime. The way this is implemented allows:
  • If somebody declares Elixir as a dependency, everything should scan as expected, but will not contain any version information
  • When the CI uses it, all version info is injected and present in the resulting SBoM