Storing user settings and plugin data files

[nightlark]

While a bunch of command line options could be given to customize Surfactant config options (or added to each input config JSON file created for new samples maybe), most users will probably have some default settings (SBOM creator "org"/"name") and set of plugins they want to run. This will require having a file in a standard location to store user configuration settings.

In addition, some plugins may have data files they require that are too large to include in a Python package, and that may benefit from updates that aren't tied to Surfactant releases. This could include databases of patterns/hashes used to match libraries for various ecosystems. Those data files are probably best downloaded by the plugin as part of a set up step, or manually by a user -- and they need to be in a standard place by default so Surfactant/plugins know where to find them (an option to override the location could be provided), as well as a directory that the user has write access to (we don't want to require admin/root).

---

It would probably be good to do a quick survey for what common tools (like git do in terms of what they provide to make editing config files easier, and where those settings are stored. Similarly, some libraries/tools that require downloading e.g. a huggingface model could be checked to see where they store those data files (in particular with Python apps, do they get stored within whatever venv directory is active?)

Windows seems to have a some standard locations (provided in environment variables so may be overridable -- note some companies may map certain user directories to NFS shares that can be unavailable when not on a company network): https://superuser.com/questions/217504/is-there-a-list-of-windows-special-directories-shortcuts-like-temp
Similarly, there is the Filesystem Hierarchy Standard on *nix systems, though the XDG Base Directory Specification may be more interesting since it seems to take the standard FHS directories and extend it to include user-specific directories. The ArchWiki has a good summary of the directories. My impression is macOS ports of software tend to use similar directories, though there may be macOS specific locations that could also be used.

TODOs:

• check where common tools store user setting files
• check what functionality common tools provide for editing config files (could just be vim/notepad)
• check where libraries that need models/data files downloaded tend to put those files
• determine which directories Surfactant should use on Windows, Linux, macOS, and possibly BSD

Thoughts/comments/alternatives?

[nightlark]

A few other things I've found that may provide idea:
https://www.reddit.com/r/learnprogramming/comments/13vfr48/where_should_i_store_user_files_like_config_files/
https://git-scm.com/docs/git-config
https://stackoverflow.com/questions/2114111/where-is-the-global-git-config-data-stored

This also ties in with #100 (user config options for plugins)

[wangmot]

While reviewing PR #178, we found the cachedir location is $HOME/.cache/cve-bin-tool. This location was outputted when running cve-bin-tool --update now.