Retroactive CycloneDX SBOM for 1.7.0 (not for merging)

[jadamcrain]

Not for merging: this branch only runs a one-off workflow that produces a CycloneDX SBOM for the already-published 1.7.0 release, which will then be attached to that release. The published .nupkg is not changed.

How

• Build evidence from the actual release: the build.json of every target from the 1.7.0 release run (35664088083).
• cargo tree generated now at dnp3 1.7.0 with the release's exact arguments (-p dnp3-ffi --target <t> --no-default-features --features tls --locked), on Windows for the Windows target and on Linux for the cross targets.
• bom-tools 0.3.0 cross-checks the two (packages and per-package features must match exactly), so the SBOM describes the shipped binaries rather than a rebuild. The allow list is dnp3 main's migrated allowed.json (Generate license reports and SBOMs from build evidence (bom-tools 0.3.0) dnp3#450, pinned commit).

Locally, the Linux targets already check out, and the regenerated report matches the published third-party-licenses.txt except for build-time crates (no longer listed), Windows-only crates (Windows target pending here), and Step Function's open-source crates (now third_party). All versions are identical.

[jadamcrain]

Done: the SBOM this produced is attached to the release (see the release assets). Closing without merging, as intended; this PR and its run remain the record of how the SBOM was generated.