New features

Added kosli attest sbom command (beta) to report a software bill of materials (CycloneDX JSON/XML or SPDX JSON/tag-value) to an artifact or trail in a Kosli flow. The SBOM file checksum, format, and a parsed summary are recorded; sbom_format and sbom_sha256 are automatically added as annotations.
Added hidden --server-side flag to trail evaluation commands, enabling server-side policy evaluation (experimental, not yet a stable contract).

What's Changed

feat(sbom): read CycloneDX and SPDX bills of materials by @AlexKantor87 in #1165
feat(attest-sbom): add kosli attest sbom by @AlexKantor87 in #1168
fix(sonar): never send the API token to a redirect target by @mbevc1 in #1170
fix(snapshot azure): reject zip entries that would extract outside the temp dir by @mbevc1 in #1175
fix(sbom): read the tool from a CycloneDX services entry by @AlexKantor87 in #1179
fix(snapshot azure): stop a container spoofing its digest in logs mode by @mbevc1 in #1176
chore: improve PR follwo-up reviews by @mbevc1 in #1181
feat(evaluate): evaluate a trail server-side behind a hidden flag by @jumboduck in #1171
fix: align review turns by @mbevc1 in #1185
refactor(aws): compare the lambda package type with the SDK constant by @mbevc1 in #1184

Full Changelog: v2.40.1...v2.41.0