security: add SPDX SBOM and Trivy vulnerability scanning

[InfinityHack3r]

Summary

Adds a hand-maintained SPDX 2.3 SBOM and Trivy-based vulnerability scanning to the CI pipeline.

Changes

• sbom.spdx.json — SPDX 2.3 SBOM documenting the project and its 2 CDN font dependencies (Share Tech Mono, Rajdhani via Google Fonts)
• .github/workflows/package.yml — new steps in the test job:
  • Generate SBOM report — reads sbom.spdx.json, outputs sbom-report.md
  • Install Trivy — via official install script (no action dependency)
  • Scan SBOM — fails build on CRITICAL findings
  • Save JSON results — full CRITICAL/HIGH/MEDIUM/LOW scan
  • Generate vulnerability report — outputs vuln-report.md
  • Upload artifact — sbom-report artifact with all 4 files, retained 90 days
  • sbom.spdx.json bundled in release zip and attached as standalone release asset

Testing

All steps verified locally via act — job succeeded with 0 vulnerabilities found.