Added attestation from intermediate multi-stage build steps

[LaurentGoderre]

This is what gets added:

{
  ...
  "AdditionalSPDXs": [
    {
      "SPDXID": "SPDXRef-DOCUMENT",
      "creationInfo": {
        "created": "2023-09-20T19:45:23Z",
        "creators": [
          "Organization: Docker, Inc",
          "Tool: docker-scout-0.24.1-2-gd3f9c2d"
        ]
      },
      "dataLicense": "CC0-1.0",
      "documentNamespace": "https://docker.com/docker-scout/fs/sbom-build-base-8ea53ed2-8747-4506-a95c-13345f58135c",
      "name": "sbom-build-base",
      "files": [...],
      "packages": [...],
      "relationships": [...],
      "spdxVersion": "SPDX-2.3"
    },
    {
      "SPDXID": "SPDXRef-DOCUMENT",
      "creationInfo": {
        "created": "2023-09-20T19:45:24Z",
        "creators": [
          "Organization: Docker, Inc",
          "Tool: docker-scout-0.24.1-2-gd3f9c2d"
        ]
      },
      "dataLicense": "CC0-1.0",
      "documentNamespace": "https://docker.com/docker-scout/fs/sbom-erlang-builder-12ef2ee7-9522-44c7-8a04-3de591c23097",
      "name": "sbom-erlang-builder",
      "files": [...],
      "packages": [...],
      "relationships": [...],
      "spdxVersion": "SPDX-2.3"
    }
  ]
}

[lukebakken]

Thanks for the contribution.

What benefit does this have for users of this Docker image?

[LaurentGoderre]

This is part of Docker's work to secure the software supply chain (I work with @tianon @ docker)

[LaurentGoderre]

@lukebakken Im a bit new to this so I had to take sa bit of time to find the best way to explain the change,

This changes doesn't affect the content of the image but rather is helping get more metadata about how the image is generated by adding more SBOM attestation.

Let me know if that makes sense.

[lukebakken]

Sure, I googled BUILDKIT_SBOM_SCAN_STAGE when you opened the PR. I figure @tianon can review this PR. Seems fine to me otherwise.

[yosifkit]

Only the erlang-builder stage needs its SBOM captured since it is from the previous stage, openssl-builder, which is from the previous one, build-base, so having all three would just add duplication in the final SBOM.

[LaurentGoderre]

I agree that the base doesn't need them but the end image pull files from both the openssl-builder and erlang-builder image so I think they both need to have it

[LaurentGoderre]

Updated by moving the scanning to the openssl layer in Alpine

[whalelines]

LGTM