New workflow to show reachable components

[prabhu]

Description

This adds a new workflow to generate an SBOM with evidences using cdxgen.

Below are some links to a sample execution

Component Evidence

https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:22410

Call Stack Evidence

https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:24079

Reachable components

https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:24559

Addressed Issue

Publishing a comprehensive SBOM with a research profile would help security researchers and AppSec stays a step ahead with vulnerabilities. For instance, below are the top 3 libraries that dependency track users could prioritize to ensure their server instance doesn't get attacked when a vulnerability becomes public.

╔═══════════════════════════════════════════════════════════════════════════════════════════╗
║                                   Reachable Components                                    ║
║                                Generated with ♥ by cdxgen                                 ║
╟─────────────────────────────────────────────────────────────────────────┬─────────────────╢
║ Package URL                                                             │ Reachable Flows ║
╟─────────────────────────────────────────────────────────────────────────┼─────────────────╢
║ pkg:maven/us.springett/alpine-infra@2.2.4-SNAPSHOT?type=jar             │ 229             ║
╟─────────────────────────────────────────────────────────────────────────┼─────────────────╢
║ pkg:maven/org.datanucleus/javax.jdo@3.2.1?type=jar                      │ 154             ║
╟─────────────────────────────────────────────────────────────────────────┼─────────────────╢
║ pkg:maven/javax.json/javax.json-api@1.1.4?type=jar                      │ 75              ║
╟─────────────────────────────────────────────────────────────────────────┼─────────────────╢

Additional Details

Related: DependencyTrack/frontend#644

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly