build(deps): Bump sbomify/github-action from 0.6 to 0.9 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: sbomify/github-action.

Updates sbomify/github-action from 0.6 to 0.9

Release notes

Sourced from sbomify/github-action's releases.

The One Where Generation Gets Modular

Changelog v0.9

New Features

• Plugin architecture for SBOM generation - Modular generator system with priority-based selection and automatic fallback (cyclonedx-py → Trivy → Syft)
• Ubuntu APT repository enrichment - Native metadata source for pkg:deb/ubuntu/* packages (LTS 18.04-24.04 + 24.10)
• Built-in schema validation - JSON Schema validation for generated SBOMs

Bug Fixes

• Fixed NTIA compliance issues for supplier and version fields
• Improved author extraction from PyPI author_email field
• Added version inheritance for lockfile components

Documentation

• Added ADR-0001: Plugin Architecture for Extensibility

The one with enrichment plugins

Changelog for v0.8.0

Major Features

Plugin-based Enrichment Architecture

• Complete rewrite of the SBOM enrichment system with a plugin-based architecture
• Queries multiple data sources in priority order to improve NTIA compliance
• 8 data sources implemented: PyPI, Debian, deps.dev, ecosyste.ms, PURL, ClearlyDefined, Repology, and RPM Repo
• Lockfile components are now enriched with metadata instead of removed, preserving dependency graph integrity

RPM Repository Enrichment (PR #69)

• Native Tier 1 enrichment for RHEL-compatible distros
• Supports: Rocky Linux 8/9, Alma Linux 8/9, CentOS Stream 8/9, Fedora 39-42, Amazon Linux 2/2023
• Extracts license, vendor/supplier, description, homepage, and download URL from official repos
• Intelligent caching at repo level for efficient batch processing

Dart/Flutter Support (PR #67)

• Added support for Dart packages via pub.dev data source
• Enrichment for pubspec.lock files

CycloneDX 1.7 Support (PR #64)

• Added full support for CycloneDX 1.7 schema
• Schema compliance tests for CycloneDX 1.4, 1.5, 1.6, 1.7

Bug Fixes

CycloneDX Tools Format (PR #64)

• Fixed spec compliance: now uses modern tools format (tools.components/tools.services) for CycloneDX 1.5+
• CycloneDX 1.4 correctly uses legacy Tool format (tools array)
• Sbomify now correctly identified as a service-based tool in 1.5+

Debian Source Rewrite (PR #67)

• Use correct API endpoint with version-specific lookups

... (truncated)

Commits

• 8275b49 Cuts 0.9
• f71cec1 Merge pull request #74 from sbomify/add-ubuntu
• 4d3f52e Adds missing ubuntu releases and fixes feedback
• 62c4bfd Updates readme
• f3b373b Copilot feedback and logic fix
• 90dc6d8 Refs copilot feedback
• ebddcc2 Add Ubuntu APT repository data source for package enrichment
• 4cde4a3 Merge pull request #73 from sbomify/more-ntia-minimum-element-work
• 9be8c48 More feedback
• 682f9b1 Fix up after some more end-to-end tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions