* Connect SBOMs with SPDX support.
This combines Jason's SPDX stuff and my SBOM stuff to support
SPDX-based SBOMs by default instead of our `go version -m`
invention.
* Make ko deps use SPDX by default
* WIP: generate ko deps in SPDX format
- copy out a bunch of BuildInfo stuff that will land in 1.18
* review comments
* have deps take --sbom flag more like Matt's new publish-time flag
* Implement ko deps
* actually add deps.go
* specify auth, useragent, platform
* stop reading tar if the context is cancelled
* chmod to the file's perms
* remove support for --platform, modules don't care about build tags
* fix copyright boilerplate
* drop fs dependency
* udpate module integration test to newer Go versions
* use entrypoint to identify the binary
* fix gosec finding, some style comments
* revert modules integration test change
