CI/CD for SBOM

[brainstorm]

CycloneDX SBOM artifacts should be generated by CI/CD (at release time?) instead of being committed to the repository.

[brainstorm]

Fixed by PR #109