Add composer.json as source for component detection

[JuergenGutsch]

I initially created the issue here microsoft/sbom-tool#478, but it seemed to be the wrong repo.

Composer is a dependency manager for PHP: https://getcomposer.org/

It would be cool to also create an SBOM out of composer.json files. That's why I ask you to add composer.json as a source for component detection. I would also be happy to help if needed.

Thanks,
Juergen

AB#2140410

[JuergenGutsch]

I think I will create a PR for you soon.

[felickz]

Composer is a supported ecosystem by the GitHub Advisory Database so this would be an awesome opportunity to support PHP with Advanced Security for Azure DevOps!

[JuergenGutsch]

I didn't continue working on that, because I had to look into CycloneDX, which supports almost all platforms to create SBOMs. I had the requirement to evaluate a dependency tracker, that checks for vulnerabilities against CVE databases like the GitHub Advisory Database. This is why I stumbled upon this repo and CyclonDX...

However, I will finish the Composer PR within the next two weeks. It is basically a clone of the NPM version. Nothing special.