Package our Sbom as an artifact with each release.

[underdarknl]

About this feature

We want to be transparant about what software is used in our builds / releases, for this we can use the sbom standard.
It would be good if we could create the sbom when we tag a release and add the artifact to the downloadable list of files.

Detailed description

See https://github.com/microsoft/sbom-tool/blob/main/docs/setting-up-github-actions.md

Feature benefit/User story

As a user I want to know what deps are used in the OpenKAT version I downloaded.

Specifications

Please add some specifications for the implementation. What needs to be implemented to match the design?

The implementation should include…

• Specification 1
• Specification 2

Additional information

Any additional information, considerations, or context that might be helpful for understanding or evaluating the feature request.

Design

This part should only be filled in by the OpenKAT design team.

Screenshots

Include screenshots of the proposed design changes here.

Figma link

Link to the Figma design for further visualization (if applicable)

Implementation

This part should only be filled in by the developers.

Possible solution

Outline your proposed solution for implementing the feature. You can include any specific ideas, designs, or functionalities here.

Alternatives considered

Describe any alternative approaches or solutions you've considered, and why you believe the proposed solution is superior.