v0.16.0-rc9

Changelog

• 740a63f feat: store SBOM files outside tar.gz artifacts
• fcdb2ec fix!: correct typo in vet check name
• 28c3ea6 fix(cache): require dependencies in local cache for cached packages
• 1aa988a fix: add --sort=name to tar command for deterministic archives
• eb5e08c fix: add -trimpath to default Go build command for reproducible builds
• 0e85232 fix: correct typos in comments and documentation
• a81e7da fix: correct typos in filename and error message
• 098444f fix: correct typos in test case names
• f8679f7 fix: make GetTransitiveDependencies return deterministic order
• 992b32f perf(cache): add environment variables for S3 cache tuning
• 32d3e47 perf(cache): return detailed download results for smarter cache decisions
• 96bae24 test(cache): use Go packages in integration test for transitive deps