Publish SBOMs with releases, upload to DependencyTrack, upgrade locked deps

[fkilfoyleld]

Same pattern as labd/ecs-deplojo (#33, #34), adapted to this repo's changie release flow.

Dependencies

• uv lock --upgrade. Clears all advisories in the locked runtime deps: Django 5.2.14 → 5.2.18 / 6.1.2, sqlparse 0.5.5 → 0.6.0, urllib3 2.7.0 → 2.8.0, djangorestframework 3.17.1 → 3.18.3, idna 3.14 → 3.20.
• Supersedes Dependabot Bump idna from 3.14 to 3.15 #11, Bump sqlparse from 0.5.5 to 0.6.0 #16, Bump djangorestframework from 3.17.1 to 3.17.2 #17, Bump urllib3 from 2.7.0 to 2.8.0 #18, Bump django from 5.2.14 to 5.2.17 #19.
• Note: on Python ≥3.12 the lock now resolves Django 6.1, which the test matrix doesn't cover yet (4.2, 5.2, 6.0). Users already get 6.1 from PyPI (Django>=4.2).

Release workflow

• After uv build, install the package + locked runtime deps only (uv sync --frozen --no-default-groups --no-editable), scan with syft, and attach django-postcode-lookup.spdx.json and .cdx.json (CycloneDX 1.6) to the GitHub release.
• New dependencytrack job uploads the CycloneDX SBOM as version <version> of oss/python/django-postcode-lookup (OSS › OSS Python), isLatest=true.
  • Uses DEPENDENCYTRACK_OSS_APIKEY (upload-only DT key, labd org secret scoped to selected repos).
  • No checkout, no repo code; only runs when the release job actually published.
  • Lives in this workflow because releases created with GITHUB_TOKEN don't trigger release events.
• Step outputs and event data now go through env: instead of ${{ }} in run:.
• persist-credentials: false on the test checkout.

Checks

• Locally: ruff check passes, pytest 6 passed.
• SBOM tested locally on Python 3.13 against this lock: 11 packages, no local paths, grype clean.
• actionlint, pinact run --check --verify-comment, zizmor (only the trusted-publishing note).

Before the next release

• Add this repo to the DEPENDENCYTRACK_OSS_APIKEY org secret's selected repos.
• Create the DT library container: setup_project_hierarchy.py --client "OSS" --folder "OSS Python" --library "oss/python/django-postcode-lookup".