[sbom] Need an sbom for the npm package #164

The npm package bundles a number of jar and php files under the plugins directory. These must be expressed in a separate sbom file. The work would likely involve enhancements to cdxgen.