We will eventually generate SPDX SBOM for each release to integrate
back into `reuse.software`.