Prerelease SBOM

[riley206-pnnl]

Summary
Adds CycloneDX Software Bill of Materials (SBOM) generation to the shared VOLTTRON pre-release workflow.
Previously, the full-release workflow generated SBOM data, but the pre-release workflow only built and published Python distribution artifacts. As a result, pre-release GitHub releases did not include an SBOM.
Changes

• Updates github-tooling/.github/workflows/deploy-pre-release.yml.
• Installs Node.js 20 and the @cyclonedx/cdxgen tool during eligible pre-release runs.
• Generates a Python CycloneDX SBOM with:
  cdxgen -t python .
• Attempts to generate vulnerability-enrichment output with owasp-depscan.
• Collects bom.json and any available dependency-scan reports in sbom-reports/.
• Attaches sbom-reports/* to the GitHub prerelease alongside the wheel and source distribution.
• Runs SBOM generation only when the existing workflow determines there are non-documentation changes and a pre-release will be created.
  Behavior
  After this change, repositories using the shared deploy-pre-release.yml workflow will attach bom.json to every generated GitHub prerelease.
  When depscan succeeds, its generated report files are also attached. If depscan fails because of its vulnerability-database infrastructure, the workflow logs the error and continues so the valid SBOM is still published.
  Validation
  Tested through the forked volttron-weather-dot-gov pre-release workflow.
  The test created the GitHub prerelease v2.0.0rc1 and attached:

[riley206-pnnl]

fixes #31

[riley206-pnnl]

I need to look into this more.

[riley206-pnnl]

Further testing was done. It is working as intended. It only runs when non doc changes occur.