[Question] Guidance on how to keep versions updated and aligned

Hi all 👋
I have been experimenting with various kind of Kiota integrations and something that I found challenging from time to time is how to keep versions in proper sync.
Those reflections come from [another iteration](https://github.com/andreaTP/apicurio-registry/pull/28/files) on a Python SDK.

Those are the issues:

- Kiota version itself - updating a command line tool without a package manager is already challenging and not supported by things like `dependabot` out-of-the-box - I just realized that #2589 got closed, but only the "shallow mitigation" done with `asdf` got merged there
- Kiota library versions - here we have various "source of truth"
- dependabot - would always try to bump to latest even if Kiota(the generator) has not been upgraded, and some changes might depend on generator updates
- `kiota info` - the command line is hardly usable by non-human (can be fixed by something like #3531 ) but the issue is that it won't reflect PATCH versions bump for e.g. security-related fixes

All in all, I see that most of the tooling I'm building is based on partial workarounds to those issues, and I believe that there is no "structural way", at this point in time, to have a "completely correct" or, at least, officially supported solution.

Questions:
- have you ever thought about releasing a BOM-like artifact?
- how do you handle this situation in e.g. Graph repositories? is it all manually curated?
- I recall that there were officially documented OpenApi extensions for Kiota, can they be used to mitigate the issue?
- do you have alternatives I have not considered?

Begin with the linked apicurio-registry PR and the referenced #2589 and #3531 discussions; no repository file or test is identified in this question. Clarify whether the desired outcome is a BOM-like artifact, improved kiota info output, or another supported versioning workflow, then define acceptance criteria with maintainers.

Written by the indexing model from the issue text.