feat: generate SBOM and attach as artifact in CD workflow

Co-authored-by: thomasneuberger <23504477+thomasneuberger@users.noreply.github.com>
Agent-Logs-Url: https://github.com/thomasneuberger/TgHomeBot/sessions/919dae8a-b9a6-479b-8135-ed4e6160e078

Author: Copilot

.github/workflows/cd.yml

@@ -17,6 +17,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
 
     steps:
     - uses: actions/checkout@v4
@@ -54,5 +56,13 @@ jobs:
         tags: ${{ steps.metaApi.outputs.tags }}
         labels: ${{ steps.metaApi.outputs.labels }}
 
+    - name: Generate SBOM
+      uses: anchore/sbom-action@v0.17.2
+      with:
+        image: ${{ env.REGISTRY }}/thomasneuberger/tghomebot-api:${{ steps.imageTag.outputs.tag }}
+        artifact-name: sbom-${{ steps.imageTag.outputs.tag }}.spdx.json
+        output-file: sbom.spdx.json
+        format: spdx-json
+
     - name: Output image tag
       run: echo "Image tag ${{ steps.imageTag.outputs.tag }} published" >> $GITHUB_STEP_SUMMARY