fix: configure shared workflows for Go library

[VinnyBarton]

Summary

• generate source and release SBOMs in Go library mode
• use ReARM's native Go source SBOM generator instead of the custom Dockerfile.sbom path

Root cause

The shared SBOM workflow used executable mode, which rejects this module because it is not a main package. The ReARM custom generator used an embedded Go 1.25.7 toolchain, older than this repository's required Go 1.25.13.

Dependency

Merge shiftleftcyber/supply-chain-workflows#15 first. Its validated v1 publication workflow will then move the compatibility tag to the implementation that accepts these inputs.

Validation

• Actionlint v1.7.11
• go test ./...
• generated a CycloneDX 1.6 library SBOM locally with cyclonedx-gomod v1.12.0 and verified metadata.component.type is library