Ensure we have dependency vulnerability links for the items in the SBoM, or document where not available

[sxa]

From discussion in the secure dev call:

We should see if we can obtain pURLs needed for gcc etc. in order to link it back to be able to look up CVEs related to the product version. The investigation will need to identify where that information is stored for each project. Also can we obtain SBoMs for the dependencies which have been identified and catalogued in the SBoM?

Part of SSDF PS4.1