Add SBOM file to repository

[d33bs]

Software bill of materials (SBOM) are used to help ensure security for open source projects and users (link). This issue outlines considerations about adding the SBOM as a visible artifact with this repo (more recently, it seems common to find these as SPDX JSON files). This data is also available from GitHub's API (though it's less visible how/when this is updated). The data may be manually downloaded also. Related tooling. Ideally this would be something that could be automatically updated / checked.