chore: generate SBOM for release artifacts

[gaius-qi]

Description

Related Issue

Motivation and Context

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation Update (if none of the other choices apply)

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[fcgxz2003]

LGTM

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 36.32%. Comparing base (5c52a02) to head (a19d2e1).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3585      +/-   ##
==========================================
- Coverage   36.34%   36.32%   -0.02%     
==========================================
  Files         335      335              
  Lines       31112    31112              
==========================================
- Hits        11308    11302       -6     
- Misses      18967    18971       +4     
- Partials      837      839       +2     

Flag	Coverage Δ
unittests	36.32% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 2 files with indirect coverage changes