Add SBOM attestation

[asgrim]

https://github.com/actions/attest?tab=readme-ov-file#sbom-attestation

[macintoshplus]

For the OS specific builds, the SBOM provided by StaticPHPCli will be used if you use the prebuild binary:

crazywhalecc/static-php-cli#1118

[macintoshplus]

For the Phar, we can use the Cyclone DX composer plugin

https://github.com/CycloneDX/cyclonedx-php-composer

Or the GitHub action (same author):
https://github.com/CycloneDX/gh-php-composer-generate-sbom