NRL-1928 better SBOM

[anjalitrace2-nhs]

• trigger SBOM on release published rather than in nightly build
  • eventually would be nice to extend this pipeline to do our whole release but not now!
• upload generated SBOM to github release as well as on the action
• Our SBOM now includes:
  • python dependencies
  • terraform providers (not modules, awaiting this syft issue)
  • dependencies managed by asdf

Example

• workflow: https://github.com/NHSDigital/NRLF/actions/runs/21869935978
• release that triggered it: https://github.com/NHSDigital/NRLF/releases/tag/feature%2FNRL-1928-test-1

(will delete test release & tags once PR merged)

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: 6e083fe6e21ede80505d8ae284e1530a477cced6
URL: https://nrl1928-01ba47.api.record-locator.dev.national.nhs.uk/

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: d6630330ba81019740a71ad342ca6fc277786820
URL: https://nrl1928-01ba47.api.record-locator.dev.national.nhs.uk/

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: 3357d1244da10c67df3e2769a7e0c9afbbb92de0
URL: https://nrl1928-01ba47.api.record-locator.dev.national.nhs.uk/