Include hashes for components

[lfrancke]

No description provided.

[Shnatsel]

This issue is actually two issues:

1. Record the hashes of the generated binaries, so that a SBOM can be reliably matched to a given binary
2. Record the hashes of the source-level .crate files downloaded from package registries, to unambiguously attribute them to a specific registry version

The first one depends on #532, but the second can be implemented by parsing Cargo.lock now that cargo metadata has stabilized package identifiers as cargo pkgid format, so it is now possible to cross-reference cargo metadata output with Cargo.lock.

[Shnatsel]

Implemented by #620