Encoding "origin" in wheel and dist-info metadata (for downstream security backports)

[hroncok (Miro Hrončok)]

SBOM looks potentially interesting. I have trouble quickly finding relevant examples for this. Will try harder