breaking: Simplify SBOM result class [TAROT-3624]

[afsmeira]

The aim of this simplification is to be independent of the SBOM format itself at this point.

Downstream consumers decide if they want to unmarshal the SBOM (and how) based on it's format and spec version.

No scala tools are producing SBOMs, so none need to actually change. No scala tool is even using a version of this library that includes SBOMs.

However, golang tools can already produce SBOMs, so the golang seed needs to be updated.

codacy-trivy will also need to be updated to match the new format.

There will be a point when deploying new versions for worker and codacy-trivy when SBOM parsing will be broken but that is OK because:

• SBOM parsing failures do not result in analysis failures
• We only need SBOM parsing working during the night (SCA)

[codacy-production]

Codacy's Analysis Summary

0 new issue (≤ 1 medium issue)
0 new security issue (≤ 0 issue)
0 complexity
0 duplications

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.