Rewrite DruBOM: native PHP inventory, SPDX 3.0.1 export and advisory checks

Problem/Motivation

DruBOM generates SBOMs by calling the Anchore Syft and Grype binaries. That has several problems:

• Many hosts do not allow binaries or proc_open(), so the module cannot run there.
• Syft does not know Drupal: it cannot tell installed from uninstalled extensions, custom modules, or which library belongs to which extension.
• The current code fails on Drupal 11: the settings forms cause a fatal error during cache rebuild.
• The Grype integration copies its database into the private file system, and its database import does not work.

Proposed resolution

Rewrite the module so it runs entirely in PHP:

• Inventory: collectors for Composer packages, Drupal extensions, third-party asset libraries declared in *.libraries.yml, and npm lockfiles (versions 2 and 3). Coverage gaps such as unknown versions or unsupported lockfiles are recorded, never hidden.
• Intermediate representation: a format-agnostic snapshot model with JSON schemas in schema/.
• Formatters: a new SbomFormatter plugin type. The module ships SPDX 3.0.1 JSON-LD; other formats can be added as plugins.
• Security advisories: a new AdvisoryProvider plugin type with drupal.org, Packagist and OSV providers. No provider is enabled by default; enabling one sends package names to that service.
• Admin UI: Reports > Software inventory, with an overview, packages, security findings and snapshots, plus a settings page and a status report entry.
• Drush: drubom:generate, drubom:export, drubom:analyze, drubom:providers, drubom:status.
• Requirements: Drupal 11.3 or later, PHP 8.3, a private file system.

Remaining tasks

• Review the merge request.
• Yarn and pnpm lockfiles.
• Export severities and fixed versions to SPDX.
• VEX assessments on findings.
• Declare Drupal 12 compatibility once the next-major CI job passes.

User interface changes

New Reports > Software inventory pages and a settings page at /admin/config/system/drubom. The previous settings and report pages are removed.

API changes

New SbomFormatter and AdvisoryProvider plugin types. The previous Drush commands are replaced. The plugin APIs are experimental until the first release.

Data model changes

Snapshots and analysis runs are stored as files in private://drubom/, indexed in two new tables. An update hook keeps the last report of the previous version as a file in private://drubom/legacy/ and removes the Syft and Grype settings and state.