chore: pin @coana-tech/cli and @cyclonedx/cdxgen to exact versions

Update external tool dependencies to pinned versions:
- @coana-tech/cli: 14.12.88 → 14.12.90
- @cyclonedx/cdxgen: 11.7.0 → 11.11.0

These packages are used without tilde prefixes in the codebase,
ensuring deterministic and reproducible installations.

Author: jdalton

package.json

@@ -94,8 +94,8 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "14.12.88",
-    "@cyclonedx/cdxgen": "11.7.0",
+    "@coana-tech/cli": "14.12.90",
+    "@cyclonedx/cdxgen": "11.11.0",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",
     "@eslint/js": "9.35.0",