Add support for container SBOM report

[pditommaso]

This PR adds the support for SBOM report generation to Wave scan capability.

Key Features

• Security scan SPDX file generation: Generates Software Package Data Exchange (SPDX) files for container vulnerability scans
• New REST endpoint: /v1alpha1/scans/{scanId}/spdx to retrieve SBOM reports in SPDX format
• Downloadable reports: Files are downloaded with proper naming convention spdx-{scanId}.json
• New configuration setting: wave.scan.reports.path to specify the storage location for scan reports

Changes

• Added SPDX report generation functionality to container scanning service
• Enhanced scan controller to serve SBOM reports via REST API
• Implemented proper file download headers for better user experience
• Added configuration support for customizable report storage paths

[munishchouhan]

Tested locally:

(base) munish.chouhan@Munishs-MacBook-Pro sc-ed0ebf22c8ab0ee6_1 % cd ..
(base) munish.chouhan@Munishs-MacBook-Pro scans % ls
sc-ed0ebf22c8ab0ee6_1
(base) munish.chouhan@Munishs-MacBook-Pro scans % ls sc-ed0ebf22c8ab0ee6_1
spdx.json
(base) munish.chouhan@Munishs-MacBook-Pro scans % tail sc-ed0ebf22c8ab0ee6_1/spdx.json
      "relatedSpdxElement": "SPDXRef-Package-783630804122ce96",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-fc3c7ddc0d973954",
      "relatedSpdxElement": "SPDXRef-Package-783630804122ce96",
      "relationshipType": "DEPENDS_ON"
    }
  ]
}

[munishchouhan]

not working on dev, working on fixing it

2025-07-30 15:20:37.212	
13:20:37.212 [jobs-queue-thread-1] WARN  i.s.w.s.s.ContainerScanServiceImpl - Container scan failed - id=sc-id_1; exit=1; stdout=Error: config file "trivy --quiet image --platform linux/amd64 --timeout 15m --format json --output /efs/wave/build/sc-id_1/report.json --severity MEDIUM,HIGH,CRITICAL docker.io/library/hello-world:latest && trivy --quiet image --platform linux/amd64 --timeout 15m --format spdx-json --output /efs/wave/build/sc-id_1/spdx.json docker.io/library/hello-world:latest" loading error: open trivy --quiet image --platform linux/amd64 --timeout 15m --format json --output /efs/wave/build/sc-id_1/report.json --severity MEDIUM,HIGH,CRITICAL docker.io/library/hello-world:latest && trivy --quiet image --platform linux/amd64 --timeout 15m --format spdx-json --output /efs/wave/build/sc-id_1/spdx.json docker.io/library/hello-world:latest: no such file or directory

[munishchouhan]

tested in dev
https://wave.dev-tower.net/view/scans/sc-5680f6de54c05c54_1

(base) munish.chouhan@Munishs-MacBook-Pro tower-dev % kubectl get pods -n wave-build -w
NAME                          READY   STATUS              RESTARTS   AGE
sc-5680f6de54c05c54-1-fsjn4   0/1     ContainerCreating   0          2s
sc-5680f6de54c05c54-1-fsjn4   1/1     Running             0          7s
^C%                                                                                                                                                                                (base) munish.chouhan@Munishs-MacBook-Pro tower-dev % kubectl logs sc-5680f6de54c05c54-1-fsjn4 -n wave-build
(base) munish.chouhan@Munishs-MacBook-Pro tower-dev % kubectl get pods -n wave-build -w                     
NAME                          READY   STATUS      RESTARTS   AGE
sc-5680f6de54c05c54-1-fsjn4   0/1     Completed   0          2m28s

[munishchouhan]

@pditommaso this pr is ready for merge

[pditommaso]

@munishchouhan have a look at the conflict of the template, not sure how to solve it

[munishchouhan]

in docker

[munishchouhan]

in k8s and s3:

[pditommaso]

Nice!