[WIP] generate SBOM from "global" env

[jkowalleck]

fixes #471

• have a minimal implementation
• make sure this implementation also works if installed in a global encapsulated node-env via npx
• have the bom.metadata.component populated properly
• have tests
• have WARNING that this feature is not properly working with NPM6 not needed, npm6 will fail itself, IF it had errors, and success if possible.
• have proper help texts
• have updated README

[jkowalleck]

resulted in a preview version: @cyclonedx/cyclonedx-npm@1.8.0-alpha.5d82149ae21396f6824c94185281b9162e2a18411

@schlenk do you want to try the preview and see if it works for you?

[schlenk]

@jkowalleck Thanks.

I gave it a try and it basically works with the --global switch.

There are two small feature requests still lurking in there, to make it more useful.

1. Optionally exclude the cyclonedx-npm global install from the SBOM, as thats basically only installed to create the SBOM and mentioned in the tools metadata anyway, but not really of interest for the SBOM. (or if you want to turn it around, allow a cyclonedx-npm --global to specify the npm installation to actually use, inspecting the global SBOM of a different NPM install instead of the one it is installed into.)
2. It would be nice to specify toplevel component name/version/purl, as the component that ends up in the metadata is a bit lacking, and always need post processing. This is usually provided by the package.json file, so it is missing for the global case e.g.

    "component": {
      "type": "application",
      "name": "img",
      "bom-ref": "-/img@-",
      "purl": "pkg:npm/img",
      "properties": [
        {
          "name": "cdx:npm:package:path",
          "value": ""
        }
      ]
    }

[jkowalleck]

Thanks for the feedback, @schlenk .
The alpha build's purpose was to see if it was practical and possible to create needed data.
You confirmed it to work.

Your notes regarding bom.metadata.component will be taken into account.

Be aware, that I might yank the special version at some time, so it will not be possible to install it anymore.
Please refrain from using it in production.