how to create a sbom for a Bundle

I would like to have insight into what dependencies (+ transitive) / packages / libraries / licenses are being distributed by a Bundle

Having an sbom is a good standard to follow, however generating an sbom for a bundle doesn't capture any of the dependencies brought in by the referenced images. (It isn't clear to me whether it should either, since each image ref would also have its own sbom - this might require some research)

Can we have imgpkg workflow documentation (similar to the airgapped env) that outlines:

- How to generate an sbom for a bundle
- What information is captured in a bundle sbom

Start with the existing imgpkg workflow documentation for airgapped environments and review how imgpkg currently generates a bundle SBOM. Document the commands for generating one, identify whether referenced-image dependencies are included, and state exactly what dependency, package, and license information the resulting SBOM captures.

Written by the indexing model from the issue text.