Add SBOM and release provenance attestations

[erseco]

Summary

• publish a CycloneDX JSON SBOM with every tagged release
• publish SHA-256 checksums for the package ZIP and SBOM
• create GitHub build-provenance attestations for the release ZIP
• create GitHub SBOM attestations binding the CycloneDX document to the release ZIP
• use GitHub OIDC/artifact-attestation permissions instead of long-lived signing secrets
• pin the SBOM/provenance actions to explicit released versions
• add a pull-request supply-chain check that builds a test ZIP, generates a CycloneDX SBOM, validates its structure and verifies checksums
• document release integrity and verification artifacts

Stack

This PR is stacked on #34 and targets docs/generated-api.

Release artifacts

Tagged releases will contain:

• elp-parser-<tag>.zip
• elp-parser-<tag>.cdx.json
• SHA256SUMS

GitHub Artifact Attestations provide provenance and SBOM attestations for the package archive.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.4%. Comparing base (4245383) to head (e3554df).

Additional details and impacted files

@@                 Coverage Diff                  @@
##             docs/generated-api     #35   +/-   ##
====================================================
  Coverage                  92.4%   92.4%           
  Complexity                  801     801           
====================================================
  Files                        30      30           
  Lines                      2639    2639           
====================================================
  Hits                       2441    2441           
  Misses                      198     198           

Flag	Coverage Δ
unit	92.4% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.