add cyclonedx sbom from lock or release

[timkpaine]

A software bill of materials is a direct projection of a lock — the lock already pins every conda package with its exact version, build, and content hash, so the SBOM is a faithful, lossless transform.

nepenthe sbom --lock app.lock                       # from a local lock
nepenthe sbom --env ccrt --registry file:///srv/reg # from a published release
nepenthe sbom --lock app.lock -o app.cdx.json       # to a file

• sbom module: to_cyclonedx(&LockFile) -> CycloneDX 1.5 JSON. One component per distinct conda package (deduped across environments/platforms), each with a conda purl (pkg:conda/<name>@<version>?build=&subdir=), a SHA-256 hash, and its license — all read straight from the lock.
• Deterministic: components are keyed and sorted by purl, and no generation timestamp is emitted, so the same lock always produces byte-identical output (a useful property to attest, and it makes the SBOM diffable).
• CLI: mirrors the manifest command's lock-or-registry resolution; writes to --output or stdout.

[github-actions]

Test Results

180 tests  +2   180 ✅ +2   3s ⏱️ -1s
  5 suites ±0     0 💤 ±0 
  2 files   ±0     0 ❌ ±0 

Results for commit 9d9e8b2. ± Comparison against base commit e431b65.

♻️ This comment has been updated with latest results.