Expose Packages in SBoM

[maennchen]

Follow up of #14241

• Declares Erlang Dependency
• Declares elixir applications (required for purl to identify in case of elixir vulnerabilities)
• Switches back to the official ORT action repo
• Will pass the NTIA SBoM checker
  • Does not yet pass since Add Elixir Language Trademarks Policy aboutcode-org/scancode-toolkit#4131 is not yet done
• The CI will inject the version info into the ORT config & SPDX file at runtime. The way this is implemented allows:
  • If somebody declares Elixir as a dependency, everything should scan as expected, but will not contain any version information
  • When the CI uses it, all version info is injected and present in the resulting SBoM

[maennchen]

Actually I think there's one more simplification for the configuration. I'll put the PR into draft state until I know if it works.

[maennchen]

Ready for review now :)

[josevalim]

💚 💙 💜 💛 ❤️