Why SBOMs?
Multiple committers have expressed that they don't know why we're asking them to generate SBOMs.
We should pull some of the threads together to provide some coherent motivation.
Note that generating SBOMs is a means of meeting our existing requirement to generate what we have referred to as an "IP Log" in the past. Still, I'd like to have a better answer than "because we said so".