Mark release of v0.4.0

[eskultety]

Improvements:

• add support for Yarn

• document NPM support

• SBOM enhancements:

  • add cdx:npm:package:bundled, cdx:npm:package:development NPM CycloneDX properties
  • report missing hashes for pip packages
  • report missing hashes for Go modules

• pip: allow users to request wheel dependencies

• bump the container image to Fedora 38 to get Go 1.20

Bug fixes:
n/a

Depends on:

• Yarn: Add a check for missing lockfile #440
• docs: Document Yarn support in cachi2 #425

Please don't merge this sooner than the above!

Maintainers will complete the following section

• Commit messages are descriptive enough
• Code coverage from testing does not decrease and new code is covered
• Docs updated (if applicable)
• Docs links in the code are still valid (if docs were updated)

Note: if the contribution is external (not from an organization member), the CI
pipeline will not run automatically. After verifying that the CI is safe to run:

• approve GitHub Actions workflows by clicking a button
• approve the Red Hat Trusted App Pipeline container build by commenting /ok-to-test
  (as is the standard for Pipelines as Code)

[taylormadore]

🚀

[brunoapimentel]

I think it's also worth mentioning we updated to Fedora 38 / Go 1.20