Support pedigree (for forks)

We may be generating a SBOM for a forked library -- given such we would want the ability to declare our provenance (pedigree? i'm not really sure what the difference is) within the build. #427 is slightly related.

Some thoughts:

- We would probably want the ability to specify the supplier and manufacture differently, as we are a fork
- We may want to allow *additional* externalReferences, e.g. the original vcs and the current one
- I think a single ancestor is all that one would support for now?
- Would one want to manually specify the commits, or just the base? What if they are different vcs types?
- Are there standards to enforce here? e.g. always have a `upstream` remote?
- This would probably require some additional deps, e.g. maven-scm-api? is that desired?
- How would one define patches and notes? in the pom? via another file?

Start by reviewing related issue #427 and the Maven POM context mentioned here. Clarify the intended pedigree model for supplier and manufacturer, an optional single ancestor, additional externalReferences, commit or base provenance across VCS types, and patches or notes; done means the representation and required dependencies are agreed.

Written by the indexing model from the issue text.