ci: add SBOM generation and secscan run to publish workflow

[tonyandrewmeyer]

At the conclusion of the publishing workflow, use the secscan tool to generate an SBOM and run a security scan, and store those results with the workflow.

Although there's only a single artefact to run against, the workflow uses the sbomber tool to simplify the process and keep it consistent with other Charm Tech projects.

The secscan tool can only be run in the Canonical network, so the workflow is set to use a hosted runner. This prevents testing the workflow in my fork, but it is very similar to the one in canonical/operator that works.

TODO:

• Once we hear back from the security team, either add in the required secret to get sbomber package, or (hopefully) remove that requirement.
• Investigate automatically pulling the version information.

[tonyandrewmeyer]

I think I'd rather do this a slightly different way. Closing for now, and it's scheduled to happen in later SSDLC work anyway.