[EKS] [request]: Generate SBOMs for release artifacts

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I'd like all artifacts created for EKS to have a secure SBOM generated so we can track the content of them. The SBOM should probably be in a number of formats but the [OpenSSF](https://openssf.org/) [SPDX](https://spdx.dev/) format would be essential.

**Which service(s) is this request for?**
EKS.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I'd like to be able to validate and review the SBOM for EKS artifacts.

**Are you currently working around this issue?**
n/a

**Additional context**
This is related to https://github.com/aws/containers-roadmap/issues/43 for storing container image SBOMs in ECR.

**Attachments**
n/a

The issue names no repository files, tests, or entry points. Start by reviewing the EKS artifact production process and the related containers-roadmap issue #43; done would mean every EKS release artifact has a reviewable SBOM, with SPDX support as an essential format.

Written by the indexing model from the issue text.