feat: add make target to upload SBOMs to GitHub releases

[amarkdotdev]

Summary

• Add oci-upload-sbom-% make target to publish SPDX SBOMs from oci-build to GitHub releases

Fixes #154

Test plan

• Verified makefile target syntax

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign erikgb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Adds a new publish-time Make target to upload SPDX SBOM artifacts produced by oci-build into the corresponding GitHub Release, addressing the gap noted in #154 for release SBOM availability.

Changes:

• Introduces oci-upload-sbom-% targets derived from push_names.
• Implements gh release upload logic to publish *.spdx.json files from the OCI layout .sbom directory to the current release tag.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[amarkdotdev]

Would appreciate a maintainer look when folks have a slot.