Implement `component.manufacturer`

[maennchen]

Definition: The organization that created the component (common for automated builds).

Challenge: The config[:package][:organization] field exists but:

• Rarely used in public packages
• Indicates ownership/hosting, not necessarily creation
• Semantically ambiguous

From Hex.pm docs:

package.organization - The organization the package belongs to. The package will be published to the organization repository.

Alternative: Infer from GitHub organization for some cases:

case component[:links]["GitHub"] do
  "https://github.com/dashbitco/" <> _ -> 
    bom_struct(:OrganizationalEntity, version, name: "Dashbit")
  _ -> nil
end

Important

Question: ❓ Should we:

1. Only use explicit organization field (most accurate)
2. Infer from GitHub URL (more coverage but less accurate)
3. Leave it out entirely (least ambiguous)

[maennchen]

Comment from original issue:

We should probably defer the implementation of this until Hex.pm supports SLSA Build Provenance.