[sbom] Allow to skip test requires

[Ka0o0]

This PR adds an option to exclude the test requires dependencies from the resulting SBOM.

Closes #144

[CLAassistant]

All committers have signed the CLA.

[memsharded]

Thanks for the contribution @Ka0o0

The SBOM generation has moved to Conan client as a built-in functionality, and the functions there already implement add_tests=False argument. Have you checked it?

I think this extension won't be maintained anymore, and will probably be fully deprecated and removed after some time.

[Ka0o0]

Hi @memsharded,

thanks for the hint. I have seen it, yes, but to my understanding this workflow requires me to edit my conanfile which does not work in my case where I am building a central CI job that generates SBOMs for a multiple different conan projects. In this case I think it's easier to have a tool that analyzes and generates the SBOM from "outside" based on the existing conanfile.

[memsharded]

thanks for the hint. I have seen it, yes, but to my understanding this workflow requires me to edit my conanfile which does not work in my case where I am building a central CI job that generates SBOMs for a multiple different conan projects. In this case I think it's easier to have a tool that analyzes and generates the SBOM from "outside" based on the existing conanfile.

No, it is not necessary to modify the conanfile.py at all. The functionality can be used in hooks, and one of the benefits is that it also allows to store the sboms inside the package metadata too if desired. See for example the docs in https://docs.conan.io/2/security/sboms.html#usage-examples, the first usage example is not modifying the conanfile, but using a hook.