Include build VCS + env information in SBOMs

Binaries built using Go 1.18+ have extra info embedded, e.g., for `ko` itself:

```
build -compiler=gc
build CGO_ENABLED=0
build CGO_CFLAGS=
build CGO_CPPFLAGS=
build CGO_CXXFLAGS=
build CGO_LDFLAGS=
build GOARCH=amd64
build GOOS=darwin
build GOAMD64=v1
build vcs=git
build vcs.revision=895cff9823bdde4341ebd3b1893307a42d12e1f4
build vcs.time=2022-03-28T13:55:53Z
build vcs.modified=true
```

We should collect this and put it into SPDX and CycloneDX SBOMs.

Locate the SBOM generation entry points for SPDX and CycloneDX, then inspect how Go binaries expose build settings and VCS metadata. Add the collected build and VCS information to both SBOM formats, and verify that each output contains it.

Written by the indexing model from the issue text.