sbom-action — ship an SBOM with every release, automatically

A composite GitHub Action that generates a Syft SBOM (SPDX/CycloneDX), optionally gates on missing licenses, signs it with Cosign, and attaches it to the GitHub Release.