IONOS(github): add SBOM generation workflow

[thlehmann-ionos]

1. Generate SBOMs for composer and NPM dependencies
2. Merge composer + NPM into one SBOM
3. Upload the SBOM to dependency track

== NPM SBOMs

SBOMS can be generated without installing dependencies. However, the
SBOMs would not contain description and source information, which is
only available after install of the dependencies.

== Merged SBOM

The merged SBOM may contain invalid values derived from the branch name,
which prevents the SBOM from being uploaded. This is fixed using an awk
command after merge.

== CycloneDX

cyclonedx-cli is used as container image. It was pushed from its
original source 1 into our container registry.

[Copilot]

Pull Request Overview

This PR adds a complete GitHub Actions workflow to generate, merge, and upload SBOMs for Composer and NPM dependencies across the main codebase, theme, and various apps.

• Introduces generate-sbom job to produce SBOMs for Nextcloud, theme, and custom/external apps
• Adds merge-sboms job to combine Composer and NPM SBOMs (and strip problematic metadata)
• Implements upload-sboms job to send final SBOMs to Dependency Track

Comments suppressed due to low confidence (3)

.github/workflows/sbom.yaml:79

• [nitpick] The SBOM generation steps for each app and theme are largely repetitive; consider using a YAML matrix or anchors to reduce duplication and simplify maintenance.

      # Theme

.github/workflows/sbom.yaml:100

• [nitpick] The output BOM filename 'bom.hidrive-next-theme.xml' uses a different naming pattern than the 'bom.app-*.xml' files; consider renaming it for consistency (e.g., 'bom.app-ionos-theme.xml').

          npx @cyclonedx/cyclonedx-npm --ignore-npm-errors --output-format XML --output-file '../../../bom.hidrive-next-theme.xml'

.github/workflows/sbom.yaml:375

• This AWK script strips metadata based on exact indentation; it may fail if the XML format changes. Consider using an XML-aware tool (e.g., xmlstarlet) or matching tags irrespective of whitespace for robustness.

            awk '/^  <metadata>/ { ignore=1 } /^  <\/metadata>/ { ignore=0; next; } { if (!ignore) print }' bom.xml >bom.${1}.xml ;

[printminion-co]

Let's do changes in order to simplify configuration, add versions for dependency track for better track-a-bility.

See #193 for inspiration.