sbom: spdx: generates modules that are present in the workspace but disabled or not used

[GeorgeCGV]

During SBOM generation, the walker relies on the application metadata file located at KERNEL_META_PATH, which lists all modules present in the workspace, regardless of whether they are enabled (actually used in the application build).

This becomes problematic when using the T3: Forest topology, as the resulting SBOM will include modules that are not relevant to a specific application build. Generally, regardless of topology, a module will appear in the SBOM if it is present in the workspace due to a manifest entry even when it is not enabled or used by the application.

@kartben @pdgendt, what would be the best approach to exclude disabled (not build modules) from the SBOM? One way might be to cross-reference with compile_commands.json and omit modules from SBOM for which no compile instructions are found.