feat: generate tooling SBOMs in CI

[mfahlandt]

Summary

• add a push/pull_request tooling SBOM workflow for this repository
• generate a Waybill SPDX SBOM from the checked-out commit archive for repo tooling
• generate a second SPDX document for the GitHub Actions and downloaded tools involved in SBOM generation

Notes

• the repo tooling SBOM is built from git archive HEAD so only committed content is captured
• the CI/generation-chain SBOM explicitly includes the workflow and helper script that produce the SBOMs