As part of #25, we want to add SBOM end-of-life checking, following how
Renovate has implemented it with an interface to implement, some code to
orchestrate the processing of this, with the relevant dependencies, and
then surface this data for advisories' `RetrievePackageAdvisories`.

The code is largely copy-pasted from the existing Renovate code, with
some minor tweaks to handle the slightly different database structure
SBOMs uses.

This doesn't actually implement any checks, just provides the plumbing
to make it possible to do so.

Closes #25.