Generate the license report and a CycloneDX SBOM with bom-tools 0.3.0 at the next release #7

Goal

Generate this repo's third-party-licenses.txt and a CycloneDX SBOM with bom-tools 0.3.0, the way upstream rodbus does since stepfunc/rodbus#201, and embed the SBOM in the .nupkg and attach it to the release.

When

With the first upstream rodbus release that contains stepfunc/rodbus#201. That tag has the evidence script (.github/scripts/build-evidence.sh) and the allowed.json migrated for bom-tools 0.3.0; the current ref (1.5.0) has neither. Until then this repo keeps working on bom-tools --tag 0.2.1.

Changes to ci.yml

• ref: (three checkouts): bump to the new upstream tag.
• Build steps (Windows and cross): replace the cargo build / cross build ... --message-format json > ffi-modules/<target>/build.json lines with upstream's script, keeping this repo's arguments (--features tls, no serial), e.g.
  bash .github/scripts/build-evidence.sh evidence/ffi/${{ matrix.target }} cross -p rodbus-ffi --target ${{ matrix.target }} --no-default-features --features tls
  (shell: bash on Windows). It builds and records build.json, tree.txt and runtime-tree.txt from the same arguments, and requires --target, which all jobs already pass.
• Upload evidence as an evidence-<target> artifact next to ffi-modules.
• Packaging:
  • install bom-tools with cargo install --locked --git https://github.com/stepfunc/bom-tools.git --tag 0.3.0 (replaces allow-list 0.2.1);
  • download the evidence-* artifacts into evidence;
  • cargo metadata --format-version 1 --all-features --locked > metadata.json;
  • bom-tools licenses -e evidence/ffi --root-package rodbus-ffi -m metadata.json -c allowed.json > third-party-licenses.txt;
  • bom-tools sbom -e evidence/ffi --root-package rodbus-ffi -m metadata.json -c allowed.json --lockfile Cargo.lock > sboms/rodbus-ffi.cdx.json and upload sboms;
  • package with -f third-party-licenses.txt -f sboms/rodbus-ffi.cdx.json to embed the SBOM in the .nupkg.
• Release: add artifacts/sboms/*.cdx.json to the release files.

Notes

• The upstream allowed.json covers these tls-only builds; for 1.5.0 the regenerated report matched the published one except for build-time crates (no longer listed) and Step Function's open-source crates (now third_party).
• The 1.5.0 release already has a retroactive rodbus-ffi.cdx.json attached, generated by the one-off workflow in Retroactive CycloneDX SBOM for 1.5.0 (not for merging) #6.
• Reference implementations: Generate license reports and SBOMs from build evidence (bom-tools 0.3.0) rodbus#201 (CI) and Retroactive CycloneDX SBOM for 1.5.0 (not for merging) #6 (the same steps against a release tag).