Generate BOM "metadata" section

[cyclonedx]

Generate BOM "metadata" section

[TedDriggs]

@stevespringett I've got most of this working and will submit a PR soon. For the component section the code needs to decide whether it's dealing with a library or application. This is a bit tricky, since a crate can contain both. For now, I've gone down the path of "if it has a binary target, it's an application", since I'd expect that to be the default that someone would want. Please let me know if there's a better way.

[stevespringett]

@TedDriggs I think that's a reasonable approach.

[khuey]

Was a plan for cargo workspaces ever designed/implemented?

At my company all of our code lives in a single giant workspace. We want to produce a SBOM for certain crates that are distributed to our customers, but there are other crates that are not redistributed and pull in their own dependencies that we would prefer not to include (both to ensure that we're providing our customers with only relevant information and to avoid leaking implementation details of nonredistributed binaries).

[lfrancke]

As far as I read this what's missing is better handling of packages with multiple targets (e.g. library and binary) for which a draft PR is up. It will almost certainly not be merged in its current form but it's something we'll work on.

@khuey If you're still interested in this issue please ping here. I'm not 100% sure I understand what you're looking for. This will work with workspaces and it will create a BOM for all of them by default. There is no way to skip a workspace member right now but that shouldn't hurt as you don't have to distribute that bom?