Add SBOM to release payload

[davidmrdavid]

This PR adds the SBOM payload, inside the _manifest folder, to our PyPI package.

The manifest file can be found in different places depending on whether the user downloads an sdist distribution, or a whl distribution.

Inside the sdist, they'll find the manifest in a directory of the same name at the root of the code. See below.

Inside the whl, they'll find the manifest inside the data > _manifest sequence of directories, as evidenced below:

[davidmrdavid]

@bachuv: Just FYI, this is the corresponding Python work for the latest cybersec requirement