SBOM to protect against supply chain attack

[koppor]

Idea from jdx/mise#2441

I think, the user aksa for gg.cmd.sbom (or similar) containing a list of fetched files, their version and SHA vakue. Maybe similar to a .lock file. - Haven't thought through, but wanted to share the idea.

[eirikb]

Doing some housekeeping in old discussions.

I think this ends up being the same thing as #246 (lockfile), just from the security side. A lockfile with hashes per platform is more or less the SBOM.

Keeping it in #246 so it doesn't live two places. Closing this one.