build(deps): Bump sbomify/github-action from 0.9 to 0.10 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: sbomify/github-action.

Updates sbomify/github-action from 0.9 to 0.10

Release notes

Sourced from sbomify/github-action's releases.

The One Where They Finally Added Java

Changelog v0.10

New Features

Upload Plugin Architecture

• Implement multi-destination upload support via UPLOAD_DESTINATIONS environment variable
• Add Dependency Track as a new upload destination with DTRACK_* prefixed configuration variables
• Support uploading to multiple destinations simultaneously (e.g., sbomify,dependency-track)
• sbomify credentials now only required when uploading to sbomify

Additional Packages Injection

• Inject packages not captured by lockfile scanning (vendored code, runtime deps, system libraries)
• Auto-detect additional_packages.txt convention-based file in working directory
• Support custom file location via ADDITIONAL_PACKAGES_FILE environment variable
• Support inline PURLs via ADDITIONAL_PACKAGES environment variable (comma or newline separated)
• Merge and deduplicate packages from all sources before injection

cdxgen Generator

• Add cdxgen as a new SBOM generator (priority 20) with ecosystem-aware scanning
• Best-in-class support for Java/Maven (pom.xml, build.gradle, gradle.lockfile)
• Support for Python, JavaScript, Go, Rust, Ruby, Dart, C++, PHP, .NET, Swift, Elixir, Scala, and Docker images
• Run cdxgen from lock file directory for consistent behavior
• Add --required-only and --fail-on-error flags for stricter builds

CycloneDX 1.3 Support

• Add CycloneDX 1.3 schema for validation and output

Improvements

PURL Normalization and Sanitization

• Add PURL normalization to fix common encoding issues (double @@, %40%40)
• Detect and filter invalid PURLs:
  • File references (local workspace packages)
  • Link references (npm link)
  • Path-based versions
  • Invalid root namespace
  • Missing versions (for ecosystems that require them)
• Extend PURL sanitization to tools.components in generated SBOMs
• Add stub components for orphaned dependency graph references

VCS URL Normalization (SPDX Compliance)

• Normalize VCS URLs to SPDX-standard format:
  • scm:git:... → strips prefix, normalizes inner URL
  • git@host:path → git+https://host/path
  • Known git hosts (GitHub, GitLab, etc.) → adds git+ prefix
• Expand allowed URL schemes to include SPDX VCS schemes (git, git+ssh, git+https, git+http)
• Recognize 15 known git hosting providers for automatic normalization

Expanded Lockfile Support

... (truncated)

Commits

• 57f1d33 Merge pull request #89 from sbomify/cut-0.10
• c7fefdd Cut 0.10
• 11f68f5 Merge pull request #88 from sbomify/more-sanitization
• b8806f9 refactor: simplify _is_known_git_host signature
• ba545f5 refactor: address PR review feedback (round 2)
• 7eaab87 refactor: address PR review feedback
• e86376e docs: address PR review feedback on docstrings
• e4f9c0a docs: address PR review feedback on docstrings
• 87d8ddc feat: extend PURL sanitization to tools.components and normalize VCS URLs
• 6574b4e Merge pull request #87 from sbomify/tweak-path
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions