Update for CNB spec 0.8 (Including SBOM support)

[Malax]

Updates libcnb.rs to target CNB spec 0.8. Changes between 0.6 and 0.8 are minimal with the exception of SBOM support which takes up the majority of this PR. I opted to not open a 0.8 branch and target multiple PRs to it to speed up the process. Look at individual commits for easier review.

Relevant Documentation

• Upstream CNB Buildpack API 0.8 Release Notes
• Upstream CNB Buildpack API 0.7 Release Notes
• Upstream CNB Buildpack Specification: Software-Bill-Of-Materials

Note on Cloud Native Buildpacks RFC 100

In version 0.8, a change has landed that added environment variables for values that were previously command line arguments to /bin/detect and /bin/build. This is an optional change since the classic command line arguments are still passed in and will never be removed (ref). I decided to not switch over to the environment variables for this PR to keep it smaller. We can easily decide later to make the switch. Right now, I see no benefits for libcnb.rs itself or its users.

Highlight: SBOM Support

Since the CNB specification supports multiple SBOM formats and there are many ways to generate and represent them, libcnb.rs treats them as raw bytes with attached metadata about the format.

This means there is no direct support for generating an SBOM file with libcnb.rs. Buildpack authors are expected to leverage external tooling such as build tool plugins or Rust crates to generate SBOM files.

We expect most buildpacks to use language specific tooling directly instead of implementing SBOM generation themselves. Examples are cyclonedx-maven-plugin, sbt-bill-of-materials, cyclone-dx-gradle-plugin, cyclonedx-ruby, cyclonedx-rust-cargo. Alternatively, syft has support for many ecosystems built-in: https://github.com/anchore/syft#supported-ecosystems.

libcnb.rs offers From implementations for Rust SBOM libraries (currently only cyclonedx-bom) so that these library types can be used directory with libcnb.rs without an explicit conversion step. Enable the appropriate features to gain access to them.

As the Rust SBOM ecosystem expands, we will add support for additional libraries. Support is quite sparse right now: crates.io: Crates with 'SBOM' keyword.

Highlight: SBOM Testing Support

libcnb-test was updated to allow downloading of SBOM files from a built OCI image. This feature uses pack sbom download under the hood and provides an easy way to lookup SBOM files in the rather complex directory structure pack sbom download creates.

TestRunner::default().build(
    BuildConfig::new("heroku/builder:22", "test-fixtures/app"),
    |context| {
        context.download_sbom_files(|sbom_files| {
            assert!(sbom_files
                .path_for(
                    buildpack_id!("heroku/jvm"),
                    SbomType::Launch,
                    SbomFormat::SyftJson
                )
                .exists());
        });
    },
);

Fixes #270, Fixes #271, Fixes #299, Fixes #298, Fixes #294, Fixes #269, Fixes GUS-W-10502884

[edmorley]

This is great, thank you!

Requesting changes pending the discussion about the WorkingDirectory enum vs using Option<PathBuf>.