build: decouple SBOM generation from chardet ceiling

[asimons81]

Root cause

cyclonedx-bom==7.3.0 requires chardet>=5.1,<6.0, so Dependabot PR #27 cannot resolve when it changes the constraint to chardet==7.4.3. Every CI lane fails during dependency installation before tests or packaging can begin.

Fix

• Replace the cyclonedx-bom CLI wrapper with direct cyclonedx-python-lib usage.
• Preserve the CycloneDX 1.6 artifact contract:
  • Hardproof root component and declared Apache-2.0 license
  • direct runtime dependency components
  • root dependency graph
  • reproducible marker
  • deterministic JSON with timestamp and random serial removed
  • deterministic SHA256 manifest
• Make cyclonedx-python-lib>=11 an explicit development dependency.
• Remove the now-unused cyclonedx-bom and chardet constraints.
• Expand the SBOM tests to prove byte-for-byte reproducibility and prevent the old CLI/chardet coupling from returning.

Validation

The complete repository CI matrix and CodeQL must pass before merge. This PR supersedes #27 rather than forcing an incompatible transitive major through the resolver.