Include build VCS + env information in SBOMs

[imjasonh]

Binaries built using Go 1.18+ have extra info embedded, e.g., for ko itself:

	build	-compiler=gc
	build	CGO_ENABLED=0
	build	CGO_CFLAGS=
	build	CGO_CPPFLAGS=
	build	CGO_CXXFLAGS=
	build	CGO_LDFLAGS=
	build	GOARCH=amd64
	build	GOOS=darwin
	build	GOAMD64=v1
	build	vcs=git
	build	vcs.revision=895cff9823bdde4341ebd3b1893307a42d12e1f4
	build	vcs.time=2022-03-28T13:55:53Z
	build	vcs.modified=true

We should collect this and put it into SPDX and CycloneDX SBOMs.

[imjasonh]

Throwback to #221

[imjasonh]

And #366 -- gosh, I've wanted this for a while. 🙃

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.