hooks/install: add timeouts to SBOM inspection

download_url.is_uri_valid() and go_dep.py lack timeouts. If network
probes drop or go-licenses stalls, python hangs indefinitely, causing
Kokoro builds to time out after 12 hours.

Add a 5s timeout to requests.get and a 30s timeout to go-licenses.

BUG=b/565975961
TEST=presubmit
RELEASE_NOTE=None

Change-Id: I3becae38785ce7babe60afed73dfda15c07fb07f
Reviewed-on: https://cos-review.googlesource.com/c/third_party/platform/crosutils/+/212047
Reviewed-by: Angel Adetula <angeladetula@google.com>
Tested-by: Chenglong Tang <chenglongtang@google.com>

hooks/install/sbom_info_lib/download_url.py

diff --git a/hooks/install/sbom_info_lib/download_url.py b/hooks/install/sbom_info_lib/download_url.py
index 74ecce9..a824961 100644
--- a/hooks/install/sbom_info_lib/download_url.py
+++ b/hooks/install/sbom_info_lib/download_url.py
@@ -144,8 +144,8 @@
     if not uri.strip().startswith("http"):
         return False
     try:
-        request = requests.get(uri, stream=True)
-    except:
+        request = requests.get(uri, stream=True, timeout=5)
+    except Exception:
         return False
     if request.status_code == 200:
         return True

hooks/install/sbom_info_lib/go_dep.py

diff --git a/hooks/install/sbom_info_lib/go_dep.py b/hooks/install/sbom_info_lib/go_dep.py
index cc4a324..570d68a 100644
--- a/hooks/install/sbom_info_lib/go_dep.py
+++ b/hooks/install/sbom_info_lib/go_dep.py
@@ -77,7 +77,11 @@
         ]
         start_idx += PROCESS_LIMIT
         for p in p_list:
-            output_bytes, _ = p.communicate()
+            try:
+                output_bytes, _ = p.communicate(timeout=30)
+            except subprocess.TimeoutExpired:
+                p.kill()
+                output_bytes, _ = p.communicate()
             output = output_bytes.decode("utf-8")
             if not output:
                 continue