Generate release SBOM and dependency-license report

[KeyffMS]

What changed

• add a reviewed dependency policy with allowed, denied and review-required license expressions;
• generate an SPDX 2.3 SBOM from the actual restore graph, exact .NET notice metadata, project references, workflow actions and final publish files;
• record component versions, suppliers, scopes, licenses, source references and available checksums;
• generate LICENSE-REPORT.json and DEPENDENCIES.md from the same evaluated inventory;
• fail packaging when a component is unknown, has an unreviewed/denied license or differs from its reviewed version;
• require the SBOM and license report in every binary package;
• document the release and maintenance process.

Scope

This changes supply-chain documentation and release packaging only. It does not modify SightAdapt application behavior or add application tests.

Closes #85.