Dependency License Gathering

Something Something **Software Build Of Materials** Something Something **Summary File**? Not sure if there's a Good tool for this yet we should just use. Not sure if there's a Standard Format to produce (iirc linux distros have some tooling around this we should interop with).

The issue names no files, tests, or entry points to begin with. First research existing SBOM tools and standard formats used by Linux distributions, then determine the project's interoperability requirements. Done should mean that the tool and output format are agreed and the dependency-license gathering scope is clearly defined.

Written by the indexing model from the issue text.