Add project name and version context to SBOM file name

[Rimsha2535]

Fixes #946

Checklist

Note: If any of the items in the checklist are not relevant to your PR, just check the box.

For any Pull Request

Is the following correct:

• the title of the Pull Request?
• the title of the corresponding issue?
• there are no other open Pull Requests for the same update/change?
• that the issue which this Pull Request fixes ("Fixes...") is mentioned?

When Changes Were Made

Did you:

• update the changelog?
• update the cookiecutter-template?
• update the implementation?
• check coverage and add tests: unit tests and, if relevant, integration tests?
• update the User Guide & other documentation?
• resolve any failing CI criteria (incl. Sonar quality gate)?

When Preparing a Release

Have you:

• thought about version number (major, minor, patch)?
• checked Exasol packages for updates and resolved open vulnerabilities, if easily possible?

[ArBridgeman]

Let's move this function into exasol.toolbox.util.version. That way if another command needs it later, it's easy to find.

[ArBridgeman]

Not a bad idea. Maybe instead of regenerating the name, we can set it when the nox session is executed.

@nox.session(name="dependency:sbom", python=False)
def generate_sbom(session: Session) -> None:
    """Generate SPDX SBOM for the project dependencies.

    Note: SPDX version 2 is used as no stable Python tool exists yet
    for generating SPDX version 3.
    """
    project_name, version = project_name_and_version_from_poetry(
        working_directory=PROJECT_CONFIG.root_path
    )
    sbom_filename = f"{project_name}-{version}.spdx.json"
    bom_cdx_json = PROJECT_CONFIG.root_path / "bom.cdx.json"
    bom_spdx_json = PROJECT_CONFIG.root_path / sbom_filename
    session.run("cyclonedx-py", "environment", "-o", bom_cdx_json)
    session.run(
        "sbomconvert",
        "-i",
        bom_cdx_json,
        "--sbom",
        "spdx",
        "--format",
        "json",
        "-o",
        bom_spdx_json,
    )
    session.run("test", "-s", bom_spdx_json)
    print(sbom_filename)

      - name: Generate SBOM
        id: generate-sbom
        run: |
          SBOM_NAME="$(poetry run -- nox -s dependency:sbom)"
          echo "SBOM_NAME=$SBOM_NAME" >> "$GITHUB_OUTPUT"

[sonarqubecloud]

Quality Gate failed

Failed conditions
72.7% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud