feat: generate one-time SBOMs for sandbox applications

[mfahlandt]

Summary

Add an hourly and manually triggered watcher for cncf/sandbox issues whose titles start with [Sandbox].

• Extract GitHub repositories only from the Project repo URL in scope of application field.
• Include existing open applications on activation, plus subsequently created applications even if already closed by the next poll.
• Select the latest stable release, falling back to the default branch, and resolve the selection to an immutable commit before scanning.
• Upload one SPDX SBOM per issue/repository to the dedicated sandbox-reviews bucket (overridable via OCI_SANDBOX_BUCKET) at sandbox-applications/<issue>/<owner>/<repo>.spdx.json.
• Use successful uploads as durable completion markers; retry failures, serialize watcher runs, and limit concurrent scans to five.
• Keep S3 credentials out of the scanning step and preserve generated SBOM/revision artifacts for seven days.

Dependencies and rollout

Depends on #27 for the shared upload helper and error handling. This branch currently includes that prerequisite commit; merge #27 first.

Sandbox SBOMs and the bootstrap/processing state now share the dedicated bucket. A live diagnostic using updated local credentials successfully listed, uploaded, read back, and deleted a temporary object in sandbox-reviews; no test object remains. GitHub Actions must use the same updated credentials. Activation requires list/read/write access to the sandbox-applications/ prefix, including the .started-at bootstrap marker. No watcher runs or application scans were triggered during implementation.

Validation

• 39 Python regression tests cover issue parsing, API pagination/redirects, durable checkpoints, source selection, and error handling.
• Bash regression tests cover immutable checkout, deterministic document naming, scanner failures, and invalid revisions.
• Added a credential-free regression workflow for pull requests and pushes.
• Verified live issue #525 extracts ray-project/kuberay and its latest stable release resolves successfully, without scanning or writing to the buckets.