feat: external bom

[TaurMorchant]

Design notes:

• Do not include aggregator BOMs or parent BOMs in external BOMs.
• Do not include report-aggregator BOMs in external BOMs.
• Do not include deployment artifacts (for quarkus extensions) in external BOMs.
• Do not include modules that are not published in external BOMs.
• For each existing external sub-BOM:
  • If it contains only artifacts of a single type (Java, Spring, or Quarkus), import it into the corresponding external BOM.
  • If it contains a mixed set of artifacts, add the artifacts individually to the corresponding external BOMs.
• Do not include internal BOMs (containing only third-party dependencies) in external BOMs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[robotmrv]

regarding

Do not include deployment artifacts (for quarkus extensions) in external BOMs.

Why?
We need core deployment artifacts to build our extensions.
What we should use instead ?
e.g. quarkus adds -deployment artifacts https://github.com/quarkusio/quarkus/blob/main/bom/application/pom.xml#L641