Auto-generate SPDX SBOM for each release

[swinslow]

Seeing as we've got this shiny SPDX Document creator sitting right here, we may as well run it on itself as part of the CI process for each release of tools-golang. :)

Notes:

• should be automated using GitHub Actions
• should be sure to incorporate the NTIA minimum SBOM elements