Add CycloneDX SBOM Generation and Build Traceability to helmExecute Step

Description

This PR adds CycloneDX 1.4 SBOM generation to the helmExecute step for SLC-41 compliance, and populates buildSettingsInfo in the common pipeline environment for SLC-29 build traceability.

SBOM Generation (SLC-41)

When createBOM: true is set and the chart is published, helmExecute now emits:

• bom-helm.xml: A chart-level SBOM (built with cyclonedx-go) whose root component carries a pkg:helm PURL. Sub-chart dependency versions are resolved using Chart.lock (winning over Chart.yaml ranges), and referenced images are included as container components.
• bom-docker-<N>.xml: Per-image SBOMs produced by Syft. A clean, registry-free pkg:docker PURL is injected into the root component to satisfy CycloneDX validation (workaround for anchore/syft#1408).

Container images are discovered via helm template and fall back to the containerImageNameTags CPE list when templating yields no images. SBOM generation is best-effort — failures are logged but never fail the step.

Build Traceability (SLC-29)

buildSettingsInfo is now populated into commonPipelineEnvironment.custom.buildSettingsInfo, recording helm build flags for compliance processes.

New Parameters

SBOM Reports Output

SBOM files matching **/bom-*.xml are now registered as sbom reports and can be persisted to GCS.

Tests

• Unit tests covering image discovery, chart/container SBOM assembly, PURL injection, and buildSettingsInfo population
• Integration test (TestHelmIntegrationPublishWithSBOM) that publishes to a WebDAV sink and validates the generated bom-helm.xml against CycloneDX 1.4 schema
• GHA pipelines : test of different use cases using GHA pipeline. SBOM file validation done.
• Jenkins pipeline: execution done with case helm publish=true.
• ADO pipeline: execution done with case helm publish=true.

Checklist

• Tests

• Documentation

• Inner source library needs updating

• 🔄 Regenerate and Update Summary