AWS Inspector adds plugin system for custom SBOM generation

Amazon Inspector's SBOM Generator (inspector-sbomgen) now supports a plugin system, allowing users to write custom package collectors in Lua. This enables direct inventory of new, niche, or proprietary software ecosystems without modifying the core tool or waiting for official releases. Plugins are loaded at runtime and require no compilation, facilitating rapid development and integration with Amazon Inspector for vulnerability scanning.

The plugin system is designed for quick prototyping, with plugins written in Lua that require no Go toolchain or compilation. A built-in test harness allows for immediate iteration and results, creating a tight development loop. The system abstracts artifact-type differences, allowing detection logic to be written once and applied across various artifact types.

Inspector-sbomgen plugins operate on a two-step pipeline: discovery and collection. Plugins are decoupled via an event bus, allowing a single discovery plugin to feed multiple collection plugins. The system also includes a plugin safety model to ensure secure and predictable behavior.

A command-line tool, `sbomgen plugin new`, simplifies the creation of a new plugin workspace. The generated scaffold includes example discovery and collection plugins, unit tests, and development documentation, designed to be easily understood by both humans and AI coding assistants.

Components collected by plugins are treated as first-class SBOM components and are compatible with Amazon Inspector. By adding the `--scan-sbom` flag, users can submit SBOMs generated with plugins to Amazon Inspector for vulnerability analysis, provided the components have associated advisories.