Add SBOM info generation to install hook

It wirtes the info to file `sbom-pkg-info`
for each package merged.
Example output: https://paste.googleplex.com/5945476472897536

chromite/lib/gs.py cannot be used because the class
cannot be initialized due to permission denied when creating
cache dir.

BUG=b/254334533
TEST=presbumit
RELEASE_NOTE=None

Change-Id: Iaafc26f1d9726f41d342376c971955cf2dc7c68d
Reviewed-on: https://cos-review.googlesource.com/c/third_party/platform/crosutils/+/39267
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
4 files changed