Add augmentation and enrichment to keycloak pipeline

[idunbarh]

This PR adds the remaining capabilities to the Phase 1 Keycloak workflow.

This PR adds:

• augmentation with sbomasm
• enrichment with parlay

Additionally there are several tweaks:

• Changing trivy to scan offline due to how long the workflow was running
• validating only the enriched SBOMs

You can find the SBOM Quality Scoring here.

[djmoch]

I don't see any mention of sbomasm in the README, while parlay and snyk are both discussed. Am I just missing the discussion of sbomasm? Should we add some discussion to the README?

[idunbarh]

I don't see any mention of sbomasm in the README, while parlay and snyk are both discussed. Am I just missing the discussion of sbomasm? Should we add some discussion to the README?

Its included under ...

- `Augment Keycloak SPDX` and `Augment Keycloak CycloneDX` Jobs
  - __Tool__
    - [sbomasm](https://github.com/interlynk-io/sbomasm)

I'm not super happy with how this info is presented, which leads to details being missed.

[tiegz]

looks good! Left a few minor changes/questions

[douglasdennis]

It looks like there is a bug or something in parlay where it doesn't fill in supplier information for SPDX. A quick search found this open issue: snyk/parlay#76

I didn't see a fix in there, but I've only scanned pretty quickly.

[douglasdennis]

I'm still running through some of the scorecard to see what the enrichments are doing. What would be the best way to handle that? Maybe merge this and then start opening issues that get PRs to fix? Or do we want to keep tackling stuff in this PR?

[idunbarh]

I'm still running through some of the scorecard to see what the enrichments are doing. What would be the best way to handle that? Maybe merge this and then start opening issues that get PRs to fix? Or do we want to keep tackling stuff in this PR?

My vote would be merge, and then continue to improve through additional PRs.

[dasarpjonam]

@idunbarh - Thanks for putting this together. This looks good to me. The sbomqs is too verbose. it could be a artifact. we can have a green (pass) or red(fail) stamp based on the sbomqs output.

[vpetersson]

Added minor comments.