feat: add --cdx flag for CycloneDX 1.4 SBOM output

[sonukapoor]

Adds a --cdx flag that writes a CycloneDX 1.4 JSON SBOM to a timestamped .cdx.json file. The SBOM includes all lockfile packages as components — not just vulnerable ones — with vulnerability data attached for any CVE findings.

The output block in index.ts is extracted into a new write-outputs.ts dispatcher, which now handles JSON, SARIF, and CycloneDX writes in one place.

Changes

• src/output/cyclonedx.ts — new module: buildPurl, buildCycloneDxBom, writeCycloneDxReport
• src/output/write-outputs.ts — new dispatcher replacing inline JSON/SARIF block
• src/index.ts — surfaces allPackages from scanProject; delegates to writeOutputs
• src/types.ts / src/cli/args.ts / src/cli/help.ts — --cdx flag
• action.yml — cdx input
• Docs: new cyclonedx.md, updates to cli-reference.md, sidebars.ts, README.md

Closes #349