Add SBOM file to repository

Software bill of materials (SBOM) are used to help ensure security for open source projects and users ([link](https://en.wikipedia.org/wiki/Software_supply_chain)). This issue outlines considerations about adding the SBOM as a visible artifact with this repo (more recently, it seems common to find these as SPDX JSON files). This data is also available from [GitHub's API](https://docs.github.com/en/rest/dependency-graph/sboms?apiVersion=2022-11-28) (though it's less visible how/when this is updated). The data may be [manually downloaded](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exporting-a-software-bill-of-materials-for-your-repository) also. [Related tooling](https://github.com/spdx/tools-python). Ideally this would be something that could be automatically updated / checked.