Run `cargo-cyclonedx` from Rust (instead of only in the generated CI)

Right now, `cargo-cyclonedx` is the _only_ external tool which is called by the generated CI workflow directly, instead of handled by `dist`.

It'd be useful to bring it in line with everything else and have `dist` run it directly, for consistency.

When this is resolved, it makes sense to add the `cargo-cyclonedx` check back to `do_env_test()`.

Start by tracing how dist handles external tools and how the generated CI workflow currently invokes cargo-cyclonedx. Then inspect do_env_test() and the existing checks around it. Done means dist runs cargo-cyclonedx directly for consistency with the other tools, and the cargo-cyclonedx check is restored to do_env_test().

Written by the indexing model from the issue text.