Add Python 3.15 to the supported versions (target 2026-10-15)

[hakandilek]

Python 3.15 is not generally available yet. Per PEP 790: rc1 shipped 2026-08-04, rc2 is expected 2026-09-01, and 3.15.0 final is expected 2026-10-01.

Target: 2026-10-15 (final + 2 weeks).

Current state

• requires-python already permits 3.15, so the package installs on it today. Only the advertised support matrix is missing.
• All runtime dependencies are pure-Python with no upper bound below 3.15: cyclonedx-python-lib >=3.9,<4.0, py-serializable >=3.8,<4.0, license-expression >=3.9, packageurl-python >=3.8, plus unconstrained sortedcontainers and boolean.py.
• Compiled dev tooling is ready: coverage 7.15.4 publishes 30 cp315 wheels and mypy 2.3.1 publishes 13, so no source builds are needed.
• GitHub runners already offer 3.15.0-rc.1, but it is flagged stable = false, so it only resolves with allow-prereleases until GA.

A pre-GA canary job was considered and deliberately rejected: it needs an allow-prereleases passthrough in the composite action plus continue-on-error matrix plumbing, which is not worth the CI complexity for a six-week window.

To do once 3.15.0 final ships

• Add the Programming Language :: Python :: 3.15 classifier in pyproject.toml
• Add "3.15" to env_list in tox.toml
• Add 3.15 to the build and tests matrices in .github/workflows/build-and-test.yml
• Decide whether the lint job and the coverage-badge artifact move from 3.14 to 3.15
• Verify locally with a real 3.15 interpreter via poetry run tox run
• Release as a minor version bump, since adding a supported runtime is a feature

Notes

• tox.toml sets skip_missing_interpreters = False, so adding 3.15 to env_list will make poetry run tox run fail for any contributor who has not installed 3.15. Call that out in the release notes.
• feat!: drop Python 3.10 support and remove python-dateutil dependency #158 edits the same classifier block, env_list line, and CI matrices. That PR should land first to avoid conflicts.