PyPI publication workflow: Generate package SBOM in wheel

[bact]

Add Pitloom GitHub Action to generates SBOM and put it in the wheel for publication on PyPI.

[bact]

Python 3.9 is not supported yet.
May need to revise Pitloom to lower its Python version requirement.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[bact]

Hatchling's SBOM embedding feature is only from Hatchling 1.29.0, which requires Python >= 3.10. So even Pitloom can generate the SBOM, but Hatchling will not embed the file in the wheel.

[bact]

Will see if we can inject the SBOM manually.
If we can lower Hatchling requirement to 1.27, we can support Python 3.9

[bact]

Switch to Pitloom GitHub Action, which works with Python < 3.10.

---

See wheels (*.whl) from these packages for examples of generated SBOM by Pitloom

• https://pypi.org/project/pitloom/#files - generated by Pitloom 0.16.0 Hatchling build hook
• https://pypi.org/project/licenseid/#files - generated by Pitloom 0.16.0 GitHub Action
• https://pypi.org/project/sentimentdemo/#files - generated by Pitloom 0.16.1 GitHub Action

(SBOM quality are vary by dependencies and types of files in the project. The sentimentdemo is worst, as there are lot of text files without version information.)

[JPEWdev]

Can we run this during the normal build workflow also so there are no surprises when we publish?

[bact]

Yes we can. Will update the test.yml for that. Or maybe a dedicated SBOM generation test workflow.

[bact]

.github/workflows/test-sbom.yaml is now added to run for every PR.