Add SBOMs to released packages #53

The release workflows (release-prepare.yml, release-prerelease.yml, release-publish.yml) publish packages without a software bill of materials. We left this out on purpose to keep the release workflow change small.

The ClosedXML/XLibur release workflows show one way to add it:

• SPDX embedded in the package. A GenerateSBOM MSBuild property, on in the release build only (off by default in Directory.Build.targets, so PR builds don't pay for it), adds the manifest under _manifest/ in each .nupkg.
• CycloneDX attached to the GitHub Release. The CycloneDX dotnet tool is pinned in .config/dotnet-tools.json so Dependabot keeps it up to date. A generate-sbom.sh script writes one .cdx.json per package, which is uploaded next to the .nupkg. This applies to stable releases only, because pre-releases have no GitHub Release.

Acceptance

• Stable and pre-release packages embed an SPDX manifest.
• Each stable GitHub Release has a CycloneDX .cdx.json for the package.
• docs/releasing.md describes both.