gha-sbomb-merge Merging CycloneDX v1.3/1.4 sboms into a single xml. Does not currently support signatures.