Switch to setuptools for a universal wheel, add publish.yml

[tcalmant]

Summary

• Switched the build backend from hatchling to setuptools so releases ship a single py2.py3-none-any universal wheel: javaobj still supports Python 2.7 (v1/v2), and hatchling has no equivalent of setuptools' universal-wheel flag. setup.cfg's old [bdist_wheel] flag now lives in pyproject.toml's [tool.distutils.bdist_wheel]; setup.py gained the dual-path pattern jsonrpclib uses for the same situation (Python 3 defers to pyproject.toml, Python 2.7's too-old setuptools gets explicit metadata parsed from javaobj/__init__.py)
• Added .github/scripts/check_version.py, release_notes.py, sbom_artifacts.py (ported from ../jsonrpclib, which releases the same way) and docs/changelog.md as the single source of truth for release notes
• Added .github/workflows/publish.yml: build, SLSA provenance attestation, CycloneDX SBOM, PyPI Trusted Publishing, GitHub release, modeled on ../ipopo/../jsonrpclib's workflow. Not exercised for real -- no tag pushed, no workflow_dispatch run. The PyPI trusted publisher and the pypi/testpypi GitHub environments still need to be configured before an actual release can go through this workflow
• Along the way: setuptools>=77 rejected the old License :: classifier once a SPDX license expression is set (fixed), and check_version.py caught javaobj/v2/main.py missing its version docstring entirely (fixed)

Test plan

• python -m build under a Python 3.14 container -> javaobj_py3-0.6.0-py2.py3-none-any.whl; twine check --strict PASSED on both the wheel and sdist
• Fresh Python 2.7 container, source only: python setup.py install -> real egg (not an empty/UNKNOWN one), javaobj.__version__ == "0.6.0" importing from outside the source tree
• Second fresh Python 2.7 container, wheel only (no source): pip install the exact wheel built under 3.14 -> installs cleanly (selected via the py2.py3-none-any tag), same version check passes -- the universal-wheel packaging promise is verified end to end, not just asserted by the file name
• check_version.py / check_version.py 0.6.0 exit 0; release_notes.py 0.6.0 correctly refuses (still Unreleased) and produces correct output tested against a throwaway copy with a real date
• ./run_tests_containers.sh 3.13 rerun after the packaging churn -> still 280 passed, 7 skipped
• CI (ci-build.yml -- unaffected by the backend switch, it doesn't build the package)

[coveralls]

coverage: 92.232%. remained the same — publish-ci into master