Add framework (and maybe OS) component to BOM

[Falco20019]

Somewhat related to #622

If the framework was limited using the -tfm flag, it would be useful to add it as:

{
  "type": "framework",
  "name": "Microsoft .NET",
  "version": "6.0.0"
  "cpe": "cpe:/a:microsoft:.net:6.0.0:-"
}

Not sure if it's possible to also add the OS component from the runtime identifier.

[mtsfoni]

Currently, a SBOM is meant to include delivered components.
The Framework is a dependency that needs to be already available on the target system.

Things can change if CycloneDX/specification#326 gets merged and we have extraneous components. Then it would make sense to add .NET as an extraneous component.