Add external dependencies CI/CD pipelines with SBOM generation

- Create external-dependencies directory structure with per-package pipelines
- Add DEPENDENCIES-INVENTORY.md with comprehensive dependency tracking
- Create ubuntu-26.04-build-container base image with all dependencies
- Add per-package Jenkinsfiles: log4qt, grantlee, googletest, postgresql, qt6-framework, kdreports
- Add SBOM generation script (generate-sbom.sh) for CycloneDX, SLSA v1.0, and license reports
- Integrate SBOM generation into all Jenkins pipelines
- Add external-dependencies/README.md with usage and security documentation
- Exclude proprietary license files (rti_license.dat) from git tracking

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Entire-Checkpoint: 01M6KNFNMSPW4SY4J4SQTTPVBP

external-dependencies/ubuntu-26.04-build-container/Jenkinsfile

@@ -0,0 +1,136 @@
+pipeline {
+    agent {
+        docker {
+            image 'harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04'
+            registryUrl 'https://harbor.sl.defence-elec.de'
+            args '--network=host'
+        }
+    }
+
+    environment {
+        HTTP_PROXY = credentials('http-proxy-url')
+        HTTPS_PROXY = credentials('https-proxy-url')
+        NO_PROXY = 'localhost,127.0.0.1,.sl.defence-elec.de'
+        QT_VERSION = '6.10.2'
+        KDREPORTS_VERSION = '2.3.0'
+        LOG4QT_VERSION = '2.0.0'
+        HARBOR_REGISTRY = 'harbor.sl.defence-elec.de/proxydockerhub'
+        IMAGE_NAME = 'legatus-build-container'
+        IMAGE_TAG = "ubuntu26-qt6.${QT_VERSION}"
+    }
+
+    options {
+        timeout(time: 60, unit: 'MINUTES')
+        buildDiscarder(logRotator(numToKeepStr: '10'))
+    }
+
+    stages {
+        stage('Checkout') {
+            steps {
+                checkout scm
+            }
+        }
+
+        stage('Build Container') {
+            steps {
+                script {
+                    dir('external-dependencies/ubuntu-26.04-build-container') {
+                        sh """
+                            docker build \
+                              --build-arg HTTP_PROXY=${HTTP_PROXY} \
+                              --build-arg HTTPS_PROXY=${HTTPS_PROXY} \
+                              --build-arg NO_PROXY=${NO_PROXY} \
+                              --build-arg QT_VERSION=${QT_VERSION} \
+                              --build-arg KDREPORTS_VERSION=${KDREPORTS_VERSION} \
+                              --build-arg LOG4QT_VERSION=${LOG4QT_VERSION} \
+                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} \
+                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest \
+                              .
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Verify Container') {
+            steps {
+                script {
+                    sh """
+                        docker run --rm ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} bash -c '
+                          echo "Qt6 Version:" && qmake6 --version &&
+                          echo "KDReports:" && pkg-config --modversion KDReports-qt6 &&
+                          echo "Log4Qt:" && pkg-config --modversion Log4Qt &&
+                          echo "Grantlee:" && grantlee-view --version
+                        '
+                    """
+                }
+            }
+        }
+
+        stage('Generate SBOM') {
+            steps {
+                script {
+                    dir('external-dependencies/ubuntu-26.04-build-container') {
+                        sh """
+                            mkdir -p sbom
+                            
+                            # Set environment variables for SBOM generation
+                            export GIT_URL="${env.GIT_URL}"
+                            export GIT_COMMIT="${env.GIT_COMMIT}"
+                            export BUILD_NUMBER="${env.BUILD_NUMBER}"
+                            export DOCKERFILE_PATH="external-dependencies/ubuntu-26.04-build-container/Dockerfile"
+                            
+                            # Generate CycloneDX SBOM, SLSA provenance, and license report
+                            bash ../scripts/generate-sbom.sh ubuntu26-qt6-build-container ubuntu26-qt6.${QT_VERSION} ./sbom
+                            
+                            # Generate additional component SBOMs
+                            cat > sbom/components.json << EOF
+                            {
+                              "components": [
+                                {"name": "Qt6", "version": "${QT_VERSION}"},
+                                {"name": "KDReports", "version": "${KDREPORTS_VERSION}"},
+                                {"name": "Log4Qt", "version": "${LOG4QT_VERSION}"},
+                                {"name": "Grantlee", "version": "5.3.1"},
+                                {"name": "GoogleTest", "version": "1.15.2"},
+                                {"name": "PostgreSQL", "version": "16"}
+                              ]
+                            }
+                            EOF
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Push to Registry') {
+            steps {
+                script {
+                    withCredentials([usernamePassword(
+                        credentialsId: 'harbor-credentials',
+                        usernameVariable: 'HARBOR_USER',
+                        passwordVariable: 'HARBOR_PASSWORD'
+                    )]) {
+                        sh """
+                            echo ${HARBOR_PASSWORD} | docker login ${HARBOR_REGISTRY} -u ${HARBOR_USER} --password-stdin
+                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
+                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest
+                            docker logout ${HARBOR_REGISTRY}
+                        """
+                    }
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            cleanWs()
+        }
+        success {
+            echo "Build container ${IMAGE_NAME}:${IMAGE_TAG} successfully built and pushed"
+        }
+        failure {
+            echo "Build container build failed"
+        }
+    }
+}