Capture compiler information

We're currently only capturing the Go version in `app` and `mod`.
Ideally we would also include info about the Go compiler, like hashes of `go` and most likely more.

We'll need to do some research as to what properties make sense to include in the SBOM.

This was part of the feedback in https://zt.dev/posts/analysis-cyclonedx-gomod-sbom/

Start by inspecting how Go version information is currently captured in `app` and `mod`, then read the linked CycloneDX analysis for compiler metadata expectations. Define which compiler properties belong in the SBOM, including whether hashes of `go` are appropriate, and consider the resulting metadata complete when the selected compiler information is captured consistently.

Written by the indexing model from the issue text.