sbom: create and upload

add CycloneDX, create CI job and upload result to dependency track.