Roll out SBOM generation to all S-CORE modules #3314

Description

This is a follow-up to #2592 (license & sbom action plan). SBOM tooling now exists and is integrated, but only one module produces its own SBOM. This issue tracks the remaining gaps and the rollout of SBOM generation to every S-CORE module.

Current status (2026-10-07)

• Tooling: score_sbom (eclipse-score/sbom-tool) v0.1.1 produces SPDX and CycloneDX. It covers Bazel/C++, Rust, Python and Java, uses the dash-licenses scan, and fills in SPDX license metadata (sbom-tool#13).
• Integration: reference_integration generates SBOMs in CI and uploads them for main and release builds (reference_integration#304, #343, #353, #339).
• Module adoption: only persistency uses it so far (persistency#430).
• Decision (Release Community, 2026-09-15): every module produces its own SBOM and includes it in its module verification report.

Gaps

1. SBOM content not defined: the process community hasn't said what an SBOM must contain (required fields, format, and whether dev/tool dependencies are included).
2. Verification report integration: we still need to agree how the SBOM goes into the module verification report. To be aligned with the security meeting.
3. Python license enrichment: license enrichment for Python dependencies through DASH is unresolved (sbom-tool#14 was closed without merging).
4. Rollout: the other modules don't produce an SBOM yet.
5. Onboarding guide: there's no short guide for adding score_sbom to a module.

Rollout checklist

• persistency
• baselibs
• communication
• config_management
• kyron
• lifecycle
• logging
• time
• score-crates
• other modules in reference_integration/known_good.json (diagnostics, someip gateway, ...)

For each module: add score_sbom, generate SPDX and CycloneDX in CI, attach them to releases, and link them from the verification report.

Acceptance Criteria

• SBOM content requirements are documented in process_description
• An onboarding guide for score_sbom exists
• Every module in known_good.json generates an SBOM in CI and publishes it with its releases
• Each module's verification report includes or links its SBOM
• The SBOM from reference_integration covers all integrated modules, with complete license data (including Python)