Add support for signing and signature validation

The root bom and individual components can be signed.

This enhancement request is to:
* Add support for signing the bom element and individual component elements
* Add verification of all signatures in the bom (the root bom and all components)
* Support XML Signature (via JSR 105) and JSON Signature Format(webpki.org) for inline signing cases
* Support document signatures using JSON Web Signature (jose4j?)

No files, tests, or entry points are identified. Start by locating the BOM root and component signing and validation paths, then define coverage for XML Signature via JSR 105, JSON Signature Format, and document signatures via JSON Web Signature. Done means the root and every component can be signed and all listed signature types can be verified.

Vom Indexierungsmodell aus dem Issue-Text verfasst.