Provide an easy way to map an artifact to a SBOM

A rust build can produce various artifacts in the `/target` folders.
The SBOMs might have different names (e.g. `bom.xml` or the name of the package) and it's not trivial (without parsing the SBOMs) to automatically map/match the artifact to the SBOM in question.

A second, related issue (I can split it into a separate issue) is that the `metadata -> component -> name` might be an "internal artifact" and not the name of the actual final product as used in the outside world (e.g. vulnerabilities might be filed against the "official" name or the "binary" name but not the package/crate name).

The "correct" name might be available as a subcomponent of `metadata -> component` but it's not obvious to tools which the actual thing is we're talking about (e.g. a vulnerabilty might exist in a binary but not in the library).

The only thing I can think of is to actually do create a separate SBOM file per generated artifact. That is overhead and duplication but I don't see a better way of doing this.

This was my attempt at doing this in the past and it might still be what I need: https://github.com/CycloneDX/cyclonedx-rust-cargo/pull/441

Start by reviewing the prior attempt in pull request #441 and the artifact and SBOM naming examples in this issue. Inspect how generated files under /target and metadata.component names are currently represented. Done means the project has an agreed, unambiguous way for tools to match each artifact to its SBOM and identify the externally used product name.

Written by the indexing model from the issue text.