have a `.phar` released

## Is your feature request related to a problem? Please describe.

on CI, i always need to have a php composer available in order to create an SBOM of a `composer.lock`

## Describe the solution you'd like

have a bundled `.phar` added to every release, that includes composer & the CDX composer plugin

## Additional context

acc / crit
* phar includes a version of php composer & CDX plugin
* phar bundles pinned versions of all dependencies
* lock file in the repo
* add SBOM to PHAR for to know what is in it
* building PHAR is automated part of very release
* CI tests to build PHAR and execute integration/demos on every CT run
* IDEA: https://github.com/humbug/php-scoper is part of build process