[IDEA] feat: env-based SBOM allow filtering

filtering could be based on a package-list, or based on a `requirements.txt` or `pyproject.toml`

the actual requirements are unclear. feel free to discuss below.

The issue names package lists, requirements.txt, and pyproject.toml as possible filtering inputs, but it does not identify an implementation entry point or tests. First clarify whether filtering should use an explicit package list or either project file, then define the environment-based behavior and acceptance criteria before locating the relevant generator code.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.