chore: Onboard to Silkbomb to generate SSDLC reports, SBOM and generate augmented SBOM on demand

[oarbusi]

Proposed changes

Example of SSDLC report and SBOM generation in 8584443

Link to any related issue(s): CLOUDP-325046

Type of change:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as
  expected)
• This change requires a documentation update

Required Checklist:

• I have signed the MongoDB CLA
• I have added tests that prove my fix is effective or that my feature works
• I have added any necessary documentation (if appropriate)
• I have run make fmt and formatted my code
• I have tested the CDK constructor in a CFN stack. See TESTING.md
• If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Further comments

[Copilot]

Pull Request Overview

This PR introduces a set of scripts and workflow configurations to generate SSDLC reports, SBOMs, and augmented SBOMs on demand using Silkbomb. Key changes include:

• New templates and scripts for generating SSDLC compliance reports and SBOMs.
• Added GitHub workflows for integrating SBOM generation and report updates into the release process.
• Introduced a workflow for augmenting SBOMs prior to release.

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
templates/ssdlc-compliance.template.md	New Markdown template for SSDLC Compliance Reports
scripts/compliance/upload-sbom.sh	Script to upload SBOMs to Kondukto
scripts/compliance/gen-ssdlc-report.sh	Script to generate SSDLC reports with support for augmented and standard
scripts/compliance/gen-sbom.sh	Script to generate SBOM using docker and Silkbomb image
scripts/compliance/gen-purls.sh	Script to generate PURLs from package.json dependencies
scripts/compliance/augment-sbom.sh	Script to augment SBOM via docker with Kondukto
.github/workflows/release.yml	Workflow updates to integrate SBOM generation, report generation, and upload
.github/workflows/generate-augmented-sbom.yml	Workflow to trigger augmented SBOM generation and report creation

[oarbusi]

Testing of the GH actions changes in progress(augmented SBOM + changes in the release)

[lantoli]

are we committing changes in CDK or TF repo?

[oarbusi]

to CDK. fixed, thanks