Adds a reproducibility verification check

[ForestEckhardt]

Checklist

• I have viewed, signed, and submitted the Contributor License Agreement.
• I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
• I have added an integration test, if necessary.
• I have reviewed the styleguide for guidance on my code quality.
• I'm happy with the commit history on this PR (I have rebased/squashed as needed).

[sophiewigmore]

@ForestEckhardt can you give an explainer on what this code is doing? It's not super clear to me what this is checking

[ForestEckhardt]

This is checking that the same output is generated in back to back runs to ensure that the encoding of the SBOMs is deterministic and reproducible in separate runs.

I am doing this by running two scans one at the beginning and one at the end and checking to see that the output of those two scans is identical which is should be cause the underlying thing being scanned has not changed.