include `kodata` file hashes into SBOMs?

[mattmoor]

Right now our SBOMs only track the Go binary, but we include static assets via kodata today, and those aren't represented. I think for our SBOM(s) to be truly complete we need to include kodata as well.

cc @puerco @jdolitsky @imjasonh @jonjohnsonjr

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

[mattmoor]

Was talking to @puerco about having "layer" packages, and while it is probably overkill for what we have right now, it may make sense when we do this to note that we have a layer containing the Go binary and a layer containing the kodata files.