Software bill of materials

Every release ships a CycloneDX SBOM and an enriched HTML report. Generated by scripts/generate-sbom.sh + enrich-sbom.py.