Upgrade SBOM tooling for Python 3.13+ support

[jeffreyparker]

Summary

• cyclonedx-bom 3.11.7 → 7.2.2 — the 3.x series doesn't support Python 3.13, blocking releases on newer Python versions
• cyclonedx-cli v0.24.2 → v0.30.0 — picks up CycloneDX v1.7 / SPDX 2.3 compatibility
• GitHub Actions actions/checkout v2 → v4, actions/setup-python v2 → v5

Details

cyclonedx-bom CLI change

The 4.x release of cyclonedx-bom introduced breaking CLI changes — the --e flag became the environment subcommand and JSON became the default output format:

	Old (3.x)	New (7.x)
Command	cyclonedx-py --e --format json -o cyclonedx-sbom.json	cyclonedx-py environment -o cyclonedx-sbom.json

cyclonedx-cli (sbom-convert composite action)

The download URL is bumped from v0.24.2 to v0.30.0. The convert command flags are identical between versions, so this is safe for downstream consumers of the composite action (duo_hmac_python, duo_universal_java, duo_client_java).

GitHub Actions

actions/checkout@v2 and actions/setup-python@v2 are bumped to v4 and v5 respectively — the v2 versions use deprecated Node.js runtimes.

Test plan

• Install cyclonedx-bom==7.2.2 locally, run cyclonedx-py environment -o cyclonedx-sbom.json, verify valid JSON output
• Download cyclonedx-cli v0.30.0 and run the convert command on the generated JSON to verify spdx.json is produced
• The publish workflow only triggers on release creation, so the PR itself won't exercise the SBOM step — local testing is the primary verification method