feat(action): add sbom input so SPDX output is reachable from the GitHub Action

Problem

The OWASP/cve-lite-cli action exposes a boolean cdx input, which writes a CycloneDX 1.4 SBOM. It has no equivalent for SPDX, and there is no generic argument passthrough, so SPDX output is unreachable from the action.

Users who want SPDX today have to bypass the action:

- name: Generate SPDX SBOM
  run: npx --yes cve-lite-cli@1 . --sbom spdx

That works but skips everything the action provides around the scan.

Proposed change

Add an sbom input mapping to the CLI's --sbom <format> flag, accepting cyclonedx, spdx, or spdx2.3:

- uses: OWASP/cve-lite-cli@v1
  with:
    sbom: spdx
    fail-on: high

Also consider an sbom-inventory-only boolean mapping to --sbom-inventory-only, for teams generating SBOMs for archival or attestation where the document should change only when dependencies change.

The existing cdx input must keep working unchanged. It is documented across the README, the workflow-integration guide, and the CycloneDX page, and external adopters use it in pinned workflows.

Notes

• Blocked on the SPDX output feature landing first.
• website/docs/spdx.md currently documents the npx workaround and should be updated to show the action input once this ships.

Start by inspecting the existing GitHub Action input mapping for cdx and the CLI's --sbom and --sbom-inventory-only options. Update the action configuration while preserving cdx, then update website/docs/spdx.md, the README, the workflow-integration guide, and the CycloneDX documentation; done means the documented action inputs produce the expected SPDX output after the SPDX feature lands.