Goal:

• SBOMs are already exposed by osbuild-composer
• We need to expose them as well as a downloadable artifact for each build in image-builder-crc's API

Acceptance Criteria:

• Customers can now download SBOMs for each build via the API, e.g. using curl
• As a result of the GET request, they will get a json that is valid SPDX.

Open questions:

• What should the API endpoint be called / look like?