[SBOM] Add information about the job that generated the attested artifacts

[netomi]

The sbom should contain also a reference to the build that produces the artifact and provenance, e.g. the jenkins build url.

This information could be captured as property, e.g.

• name: "Build URL"
• value: "https://ci.adoptium.net/job/build-scripts/job/jobs/job/jdk21u/job/jdk21u-aix-ppc64-temurin_SmokeTests/2/"

Furthermore, the sbom should capture information how the pipeline script was generated, i.e. include the following:

• reference the ci-jenkins-pipelines repo with digest
• reference the script that was used to generate the pipeline file

[netomi]

To give a reference how this is currently handled by SLSA. Here is an excerpt of the attestation produced for the slsa builder docker image as published here:

https://github.com/slsa-framework/slsa-github-generator/releases/download/v1.9.0/slsa-builder-docker-linux-amd64.intoto.jsonl

The reference to the actual build job is captured in metadata -> buildInvationId

to access the run you have to figure out the url yourself:

https://github.com/slsa-framework/slsa-github-generator/actions/runs/5945355419-1

[sxa]

The BUILD_URL environment variable that gets passed from jenkins should be adequate for this.
There's also RUN_DISPLAY_URL but that redirects to a BlueOcean view.
We should also look at making sure that the release pipelines don't get deleted where possible, other than the attached artefacts (which will be stored in GitHub as well as on the parent pipeline)