Create SBOMs for ASF application binary distributions

The purpose of this issue is to provide SBOMs for all ASF binary distributions, starting with those that:

- contain executable applications,
- bundle all or most of their dependencies.

These are IMHO the most critical distributions, since users can not easily upgrade vulnerable dependencies without a new release.

The following table contains a list of binary application distributions of various Apache TLPs.
Currently only 10% of the TLPs are included:

| Application | Download URL | Tool | SBOM |
| --- | --- | --- | --- |
| Accumulo | https://accumulo.apache.org/downloads/ | Maven Assembly | [ ] |
| ActiveMQ Artemis | https://activemq.apache.org/components/artemis/download/ | Maven Assembly | [ ] |
| ActiveMQ Classic | https://activemq.apache.org/components/classic/download/ | Maven Assembly | [ ] |
| Age | _only source releases_? | | [ ] |
| Airavata | https://airavata.apache.org/development.html#downloads | Maven Assembly | [ ] |
| Airflow | _only Python packages + Docker_? | Python | [x] |
| Allura | _only source releases_? | | [ ] |
| Ambari | _only source releases_? | | [ ] |
| Ant | https://ant.apache.org/bindownload.cgi | Ant | [ ] |
| APISIX | _only source releases + Docker_ | | [ ] |
| Aries | _only sample applications_ | | [ ] |
| Arrow | _only libraries_ | | [ ] |
| AsterixDB | https://asterixdb.apache.org/download.html | Maven Assembly | [ ] |
| Atlas | _only libraries_? | | [ ] |
| Avro | _only libraries_? | | [ ] |
| Axis | https://axis.apache.org/axis2/java/core/download.html | Maven WAR | [ ] |
| Beam | _only libraries_? | | [ ] |
| Bigtop | https://bigtop.apache.org/download.html#releases | Dpkg and Rpm | [ ] |
| Bookkeeper | https://bookkeeper.apache.org/releases/ | Maven Assembly | [ ] |
| Brooklyn | https://brooklyn.apache.org/download/index.html | Maven Assembly | [ ] |