Going further than Github dependabot?

[bric3]

Some quick ideas:

1. I've been a gradle-versions-plugin user, and while this plugin is only about extracting dependencies, the versions plugin had usually been struggling with such API to get those dependencies. Possibly this plugin could leverage this properly for other plugin to consume.

2. I also have been a Mend Renovate bot, I don't know how their mechanism works. But maybe they could benefit from that.

3. I don't know the state of Gradle integration with SBOM and sigstore, nor if Github will provide such integration, but could this plugin be the basis to produce an SBOM as well ?