refactor!: remove the automatic sbom generation feature for Java

[behnazh-w]

Summary

This PR removes the automatic SBOM generation feature for Java projects in Macaron.

Description of changes

The automatic SBOM generation functionality for Java (via Maven and Gradle) has been removed from Macaron. This decision was made for the following reasons:

• Avoid executing build tools: Running Maven or Gradle executables within Macaron can pose security and consistency risks.
• Build environment separation: Generating SBOMs outside of the actual build environment may produce incomplete or inaccurate results.
• Performance concerns: SBOM generation can be time-consuming, which negatively impacts the analysis time when done automatically within Macaron.

As part of this refactor:

• The SBOM generation logic for Java has been fully removed.
• Corresponding unit tests have been deleted or updated to reflect the removal of this feature.
• Documentation has been updated to no longer reference automatic SBOM generation for Java.
• cyclonedx-bom and cyclonedx-python-lib[validation] dependencies have been updated.
• The $HOME/.m2 directory in the container is empty and no longer mounted or used by the Python package.
• Update the base Dcoker image to the latest.

Related issues

Closes #56
Closes #60

[tromai]

For mvnw and gradlew used in SBOM generation, we mount $HOME/.m2 and $HOME/.gradle within the container to output/.m2 and output/.gradle in the host filesystem AND mount any ~/.m2/settings/xml and ~/.gradle/gradle.property from the host machine to ~/.m2/settings/xml and ~/.gradle/gradle.property within the container. It happens in run_macaron.sh

• # Determine that ~/.gradle/gradle.properties exists to be mounted into ${MACARON_WORKSPACE}/gradle.properties
• # Determine that ~/.m2/settings.xml exists to be mounted into ${MACARON_WORKSPACE}/settings.xml
• # Mount the necessary .m2 and .gradle directories.

We probably don't need to mount them anymore. Removing these location also requires us to update

• chown --recursive macaron:macaron "$HOME"/.m2 AND chown --recursive macaron:macaron "$HOME"/.gradle
• Maven and Gradle proxy settings in the Sphinx documentation

Some other locations:

• .m2 and .gradle in output files Sphinx documentation
• Output files of macaron analyze in the Sphinx documentation
• The build_log directory within the output directory

[behnazh-w]

we mount $HOME/.m2

Thanks for spotting the leftover references in run_macaron.sh. I think the .m2 directory should still be mounted for the GitHub attestation feature or analyzing JAR files.

[behnazh-w]

we mount $HOME/.m2

Thanks for spotting the leftover references in run_macaron.sh. I think the .m2 directory should still be mounted for the GitHub attestation feature or analyzing JAR files.

See commit 5d13ecc.

[tromai]

I have finished my first round of review.

[tromai]

LGTM. Thanks for the changes!