chore: generate sbom for release artifacts

[gaius-qi]

Description

Related Issue

Motivation and Context

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation Update (if none of the other choices apply)

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[chlins]

lgtm

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 36.30%. Comparing base (d2ef67c) to head (d00175d).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3587      +/-   ##
==========================================
- Coverage   36.32%   36.30%   -0.02%     
==========================================
  Files         335      335              
  Lines       31112    31112              
==========================================
- Hits        11302    11296       -6     
- Misses      18971    18976       +5     
- Partials      839      840       +1     

Flag	Coverage Δ
unittests	36.30% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 2 files with indirect coverage changes