chore: add release supply-chain checks

.gitea/workflows/verify.yml

@@ -14,8 +14,14 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 22, cache: npm }
       - run: npm ci
+      - run: npm audit --omit=dev --audit-level=high
       - run: npx tsc --noEmit
       - run: npm test
+      - run: npm run sbom -- artifacts/mebbling.spdx.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: mebbling-sbom-${{ gitea.sha }}
+          path: artifacts/mebbling.spdx.json
       - run: docker build --build-arg APP_VERSION=${{ gitea.ref_name }} -t mebbling:${{ gitea.sha }} .
       # Optional: configure DEPLOY_WEBHOOK_URL as a Gitea Actions secret to notify your host on a v* tag.
       - if: startsWith(gitea.ref, 'refs/tags/v') && secrets.DEPLOY_WEBHOOK_URL != ''