SBOM generation

[thlehmann-ionos]

SBOM generation using @printminion-co 's matrix approach plus applied feedback from 1:1 discussion to create individual components per artifact type instead of merging them. Reasoning: easier to find, avoids confusion when composer and NPM have the same name.

Applied feedback:

• matrix approach
• defining component version and on-the-fly creation of components via API
• artifact types are uploaded as individual SBOMs
• all SBOMs use the same parent (new repo var added)

[thlehmann-ionos]

Review feedback applied. Dummy change for DEMO moved to own branch tl/dev/sbom-generation-DEMO.

Pipeline: https://github.com/IONOS-Productivity/nc-server/actions?query=branch%3Atl%2Fdev%2Fsbom-generation-DEMO

[printminion-co]

review ok
if proposed changes accepted

[Copilot]

Pull Request Overview

This PR implements SBOM (Software Bill of Materials) generation using a matrix approach to create individual components per artifact type. The workflow generates separate SBOMs for PHP (Composer) and JavaScript (NPM) dependencies and uploads them to Dependency Track for vulnerability scanning.

• Matrix-based parallel processing of multiple Nextcloud components and apps
• Separate SBOM generation for Composer and NPM dependencies per component
• Integration with Dependency Track for automated vulnerability analysis

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}