Generate file information

[alilleybrinker]

SPDX includes recording of files which are present in a software bundle. For us at minimum this means specification of files in the current crate.

[tofay]

#10 adds file information to binary SBOMs of Rust source files used in the build.
Doesn't handle non-Rust files yet, e.g files used in build scripts.

For crate SBOMs, I suggest we use cargo package --list to get a list of the packages in the crate, and add them to the SBOM.

[tofay]

I've verified that the cargo package --list approach works fine at: tofay@992cd85#diff-42cb6807ad74b3e201c5a7ca98b911c5fa08380e942be6e4ac5807f8377f87fcR62-R82, and successfully used in on some projects that have multiple workspace members.

That builds on #9 so I'll wait til that's resolved before sending more PRs!