Add ability to source vendor SBOMs

As we're not always going to be using our own data, but may be produced by a vendor for a product