ci: SBOM generation in releases

[adamdaw]

Generate a Software Bill of Materials (SBOM) and attach it to GitHub Releases.

Context

Supply-chain security best practice (OpenSSF). An SBOM in CycloneDX or SPDX format documents all dependencies embedded in the Docker image and release artifacts.

Acceptance Criteria

• SBOM generated during release.yml workflow
• Attached to GitHub Release as artifact
• Covers: npm dependencies, pip dependencies, apt packages, vendored Lua filter

Reference: best.openssf.org, cyclonedx.org