Adopt unified SBOM workflow (parent project + latest flag)

[nevoodoo]

What changes:

• Uploads now pass parentName, attaching each version project to the repo's collection parent in Dependency-Track. This fixes new versions being created orphaned and therefore missing from the daily security digest (e.g. cpg-flow 1.4.0 on Aug 10).
• Sets isLatest on uploads from main/tags, so the parent's "aggregate latest children" collection logic tracks the newest version automatically.
• Auto-detects the dependency source: uv.lock → uv sync --frozen --no-dev; requirements.txt → uv pip install -r; otherwise installs from pyproject.toml.

[github-actions]

Vulnerability Audit

Found 9 vulnerabilities across 3 packages.
2 blocked, 7 in dev-only paths.

Blocked upstream — needs a fix in a parent package

Package	Current → Fix	CVEs	Blocked by
bokeh	3.4.3 → 3.8.2	CVE-2026-21883	hail==0.2.137 pins <3.5,>=3

Dev-only — not in production image

Package	Current → Fix	CVEs	Path
click	8.3.1 → 8.3.3	CVE-2026-7246	black → click
pymdown-extensions	10.20 → 11.0.1	CVE-2026-46338, CVE-2026-61632, CVE-2026-67422	mkdocs-material → pymdown-extensions

[github-actions]

🐳 Docker Image Built

A new Docker image has been built for this PR:

Image: australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:6c929cefcb0ffb87c3f1967c685cb15816050434

Pull command:

docker pull australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:6c929cefcb0ffb87c3f1967c685cb15816050434

🔗 View in Google Cloud Console

---

This comment was automatically generated by the Docker workflow.