Release of 0.4.0?

[matmannion]

We're currently setting up Dependency-Track for our projects and it'd be good to get the updates already in the repository published, we'd like to use CycloneDX 1.5/1.6 to verify if it gets the dependency graph working

[raboof]

I think that would be a good idea. I'd like to see #92 merged before we do. After that I can find some time to do the release (which will probably take some effort as this will be the first time releasing from org.github.sbt).

[raboof]

to verify if it gets the dependency graph working

I suspect the dependency graph depends on the "dependencies" section of the SBOM being populated, which we don't do yet. Filed #108 for that feature.