Reproducible output for SPDX SBOM

**What would you like to be added**:
Basically needs two things, based on the diff of two SBOMs I generated:
1. Allow to override `created`, for example using `SOURCE_DATE_EPOCH`, so users can set the created date to e.g. datetime of the current commit or a pre-defined value.
2. Add an option to use UUIDv5 (SHA-1 based, deterministic variant), so that the UUID corresponds to content and is reproducible.
- This is apparently allowed by SBOM specs: https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#652-intent

**Why is this needed**:
A reproducible SBOM is easy to keep track of changes in. For example, it could be committed together with other generated files and so it will be easy to see changes occurring in the SBOM alongside dependency updates.

This is also a necessity when SBOMs need to be embedded into packages to be merged later, and these packages need to be reproducible

**Additional context**:
Command currently tested: `SYFT_FORMAT_PRETTY=1 /tmp/syft/main scan . --from dir -o spdx-json --select-catalogers "+sbom-cataloger,go"`

I am willing to work on this feature once it is approved for implementation.

Start by running the listed syft command with SPDX JSON output, then trace the SPDX document creation path that produces the created timestamp and UUID. Done means exposing controls for a fixed created value and deterministic UUIDv5 generation, with repeated runs producing identical SBOM output.

Written by the indexing model from the issue text.