feat(action): add sbom input so SPDX output is reachable from the GitHub Action

[sonukapoor]

Problem

The OWASP/cve-lite-cli action exposes a boolean cdx input, which writes a CycloneDX 1.4 SBOM. It has no equivalent for SPDX, and there is no generic argument passthrough, so SPDX output is unreachable from the action.

Users who want SPDX today have to bypass the action:

- name: Generate SPDX SBOM
  run: npx --yes cve-lite-cli@1 . --sbom spdx

That works but skips everything the action provides around the scan.

Proposed change

Add an sbom input mapping to the CLI's --sbom <format> flag, accepting cyclonedx, spdx, or spdx2.3:

- uses: OWASP/cve-lite-cli@v1
  with:
    sbom: spdx
    fail-on: high

Also consider an sbom-inventory-only boolean mapping to --sbom-inventory-only, for teams generating SBOMs for archival or attestation where the document should change only when dependencies change.

The existing cdx input must keep working unchanged. It is documented across the README, the workflow-integration guide, and the CycloneDX page, and external adopters use it in pinned workflows.

Notes

• Blocked on the SPDX output feature landing first.
• website/docs/spdx.md currently documents the npx workaround and should be updated to show the action input once this ships.

[sonukapoor]

Sequencing note: this is blocked until SPDX output lands on main, since there is no --sbom flag to wire through yet. Happy for someone to pick it up now and have the PR ready, just expect it to sit until the CLI side merges.