ci: add SBOM export workflow

[dkutzmarks-rgb]

Summary

• Adds CycloneDX SBOM generation via cdxgen and uploads to Dependency Track
• Runs on push to the default branch and weekly (randomized schedule)
• Uses org-level secrets DEPENDENCY_TRACK_API_KEY and DEPENDENCY_TRACK_URL

Details

• SBOM format: CycloneDX 1.6 (required by Dependency Track)
• Generator: cdxgen v12.1.1 (Docker image)
• Runner: ubuntu-latest
• Auto-creates project in Dependency Track if it does not exist
• Skips SBOM generation if no commits in the last 7 days