Check compliance with https://github.com/chainguard-dev/bom-shelter

As we don't seem to support them