fix: use pinned npm client for SBOM

[EmersonBraun]

Summary

• keep the pinned npm client available across release steps
• generate the SBOM through the pinned npm CLI instead of the incompatible npx launcher
• extend release workflow authentication coverage

Validation

• node --test scripts/release-workflow-auth.test.mjs
• git diff --check
• npm exec --yes --package=@cyclonedx/cyclonedx-npm@2.0.0 -- cyclonedx-npm --version