[IDEA] feat: env-based SBOM allow filtering

[jkowalleck]

filtering could be based on a package-list, or based on a requirements.txt or pyproject.toml

the actual requirements are unclear. feel free to discuss below.