Support for PEP 770 (SBOMs)

[PEP 770](https://peps.python.org/pep-0770/) is accepted, and specifies how wheels can start incorporating SBOMs as metadata under `.dist-info/sboms/`.

PEP 770 does not provide metadata in the `[project]` table for SBOMs, for reasons discussed in the PEP (static + dynamic metadata is expected to be common). An earlier version did use `[project]`, and https://github.com/pypa/pyproject-metadata/pull/225 prototyped support for that in `pyproject-metadata`. That part is no longer needed, but support in a build backend will be since `.dist-info` is generated by a build backend.

Technically it's possible to do something hacky like this today in a `meson.build` file:
```meson
install_data(
'sboms/an_sbom_filename.spdx.json',
install_dir: py.get_install_dir() / meson.project_name() + '-' + meson.project_version() + '.dist-info' / 'sboms',
)
```
But obviously that isn't recommended.

What we need instead is this in `pyproject.toml`:
```ini
# static SBOM files that go into all wheels
[tool.meson-python.sboms]
sbom-files = [
"sboms/component1.spdx.json",
"sboms/component2.spdx.json",
]
```
That's the basic support. There are also cases possible where a vendored component only gets included in wheels for say one platform, or if a particular build option is given. That's a lot harder to deal with, and could be done either in `[tool.meson-python]` or through some mechanism with data files in `meson.build` files (e.g., install_data(..., install_tag: 'sbom')` - lots of options and more limited needs, so let's leave that for the future I'd say.

It'd be nice to align this with other backends, so the mechanism looks similar.
- `scikit-build-core`: I don't see an issue yet, Cc @henryiii for thoughts
- `maturin`: open feature request at https://github.com/PyO3/maturin/issues/2554

Start with PEP 770 and the proposed [tool.meson-python.sboms] section in pyproject.toml, then compare it with the existing Meson install_data approach in meson.build. Implement the basic static-file case so configured SBOM files appear under .dist-info/sboms/ in every wheel; platform- or option-specific cases are explicitly deferred.

Written by the indexing model from the issue text.