Reachable slices + Bug fixes

[prabhu]

• Support for generating call stack evidence based on reachables (aka evidence of reachable components)
• Improved yarn.lock v1 parsing to deal with aliases
• Fixes Add support for PyPi index as environment variable #653 gradle dependencies task fails on large gradle projects #649
• Improves support for docker library images by retrying without the library prefix
• Reliably disable any db updates from trivy by creating a fake cache dir and excluding jar files. Workaround for Trouble with trivy and java db cdxgen-plugins-bin#9

How to test?

See the delta in repotests.

1. cdxgen must be invoked with the --deep argument, and bom.json must be placed within the same application directory
2. run evinse using the --with-reachables argument

https://github.com/CycloneDX/cdxgen/blob/feature/reachable-slice/.github/workflows/repotests.yml#L158-L159

[prabhu]

@setchy, do you have any IDE configured to do automatic merges? Can you avoid using automatic push/pull since it is affecting the history.

[prabhu]

Let's merge this and continue on part 2.