Implement Manifest Parser for OpenSSF GUAC

> [Graph for Understanding Artifact Composition (GUAC)](https://guac.sh/) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance. [^1]

Since CD has graph output from our Manifest, integrating CD into GUAC is very attractive for them. They would like us to help contribute a parser in Go that can parse our manifest file.

We should also consider #570 to ensure a stable contract.

[^1]: https://github.com/guacsec/guac
```[tasklist]
### Tasks
- [x] Create JSON Schema For Manifest
- [ ] https://github.com/microsoft/component-detection/issues/570
```

Start by reviewing the Manifest JSON Schema and issue #570, which is identified as relevant to establishing a stable contract. Determine the required Go parser scope and GUAC integration expectations; done means the manifest can be parsed and its graph output is consumable by GUAC.

Written by the indexing model from the issue text.