As part of #21, we want to add support for importing Software Bill of
Materials (SBOMs) from various sources.

To start with, we can create the underlying data model + wire it in as a
Repository, and produce the domain model for an SBOM dependency.