Add Supplier Support in JSON encoded SBOMs

[puerco]

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR modifies the json serializer to add the supplier and originator data. It seems that we forgot to add it to the type and SBOMs encoded in JSON were missing the supplier info. It's there now:

    {
      "SPDXID": "SPDXRef-Package-SPDXRef-Package-index.docker.io-library-debian-f5802c738e07905ae30f1006c922c1cce3a4955574751a44d5344e9cefabca8c-sha256-015f7b32198b1c57333fa9e151a0b54ccfe05dfef57e98b87c27d426f134db80-66d94da4-a71b-40b7-adc6-6d927d0f47e1",
      "name": "libp11-kit0",
      "versionInfo": "0.24.1-2",
      "filesAnalyzed": false,
      "supplier": "Person: Debian GnuTLS Maintainers (pkg-gnutls-maint@lists.alioth.debian.org)",
      "copyrightText": "NOASSERTION",
      "checksums": [],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceLocator": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=arm64",
          "referenceType": "purl"
        }
      ]
    }

None

Special notes for your reviewer:

This PR also adds a unit test to ensure we are parsing the data in the debian db as expected.

/cc @kubernetes-sigs/release-engineering

Does this PR introduce a user-facing change?

JSON-encoded files now include supplier and originator data.

[k8s-ci-robot]

@puerco: GitHub didn't allow me to request PR reviews from the following users: kubernetes-sigs/release-engineering.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR modifies the json serializer to add the supplier and originator data. It seems that we forgot to add it to the type and SBOMs encoded in JSON were missing the supplier info. It's there now:

   {
     "SPDXID": "SPDXRef-Package-SPDXRef-Package-index.docker.io-library-debian-f5802c738e07905ae30f1006c922c1cce3a4955574751a44d5344e9cefabca8c-sha256-015f7b32198b1c57333fa9e151a0b54ccfe05dfef57e98b87c27d426f134db80-66d94da4-a71b-40b7-adc6-6d927d0f47e1",
     "name": "libp11-kit0",
     "versionInfo": "0.24.1-2",
     "filesAnalyzed": false,
     "supplier": "Person: Debian GnuTLS Maintainers (pkg-gnutls-maint@lists.alioth.debian.org)",
     "copyrightText": "NOASSERTION",
     "checksums": [],
     "externalRefs": [
       {
         "referenceCategory": "PACKAGE-MANAGER",
         "referenceLocator": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=arm64",
         "referenceType": "purl"
       }
     ]
   }

None

Special notes for your reviewer:

This PR also adds a unit test to ensure we are parsing the data in the debian db as expected.

/cc @kubernetes-sigs/release-engineering

Does this PR introduce a user-facing change?

JSON-encoded files now include supplier and originator data.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cpanato]

/lgtm

thank you

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cpanato, puerco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [cpanato,puerco]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment