CI: Add automated PQCA CBOM (Cryptography Bill of Materials) generation

[xaexaex]

Description

This PR adds a GitHub Action to automatically generate a CycloneDX 1.6 Cryptography Bill of Materials (CBOM) for the Bouncy Castle project upon demand.

As the industry transitions to Post-Quantum Cryptography (PQC), global regulatory frameworks (such as US Executive Order 14028, NIST guidelines, and EU DORA) increasingly mandate strict cryptographic asset visibility. By utilizing the official Linux Foundation / PQCA cbomkit-action, this workflow automatically inventories all cryptographic primitives (including ML-KEM and SLH-DSA) and attaches the resulting cbom.json as an artifact.

Motivation

Providing a verifiable CBOM allows enterprise consumers worldwide to immediately validate Bouncy Castle's PQC readiness and integrate the library's cryptographic inventory directly into their global compliance and risk management pipelines.

Licensing & Safety

• Tooling: This workflow utilizes the cbomkit-action provided by the Post-Quantum Cryptography Alliance (Linux Foundation).
• License Compatibility: The action is licensed under Apache-2.0, which is fully compatible with Bouncy Castle's MIT License. No third-party code is ingested into the Bouncy Castle source tree; this strictly operates as a CI analysis step.

Testing

• Tested on my personal fork.
• Successfully generated a cbom.json containing 301 cryptographic assets mapping both classical and PQC algorithms.