fix: support Go library SBOMs and native ReARM generators

[VinnyBarton]

Summary

• add a validated component-type input to the Go source SBOM workflow
• preserve executable generation by default and use cyclonedx-gomod mod -type library for library modules
• add a validated ReARM source generator input so Go callers can avoid repository-defined custom Docker builds
• document the compatibility and security implications

Failure addressed

• sbom-validator is a library, so cyclonedx-gomod app rejects it because it has no main package
• the ReARM custom SBOM image uses Go 1.25.7 while sbom-validator requires Go 1.25.13; ReARM's native Go generator avoids that stale embedded toolchain

Security impact

Inputs are restricted to explicit allowlists and privileged behavior remains disabled for pull-request events. The existing custom ReARM mode remains the default for backward compatibility, but callers can select the narrower native generator. No permissions or secrets were added.

Validation

• workflow policy script
• ShellCheck
• Actionlint v1.7.11
• Zizmor regular persona (no findings; local run was offline, CI performs online audits)
• generated a CycloneDX 1.6 SBOM for sbom-validator using mod -type library and verified its component type