feat: Add sbom-flags input and harden SBOM steps

[vatsalyagoel]

Summary

• Adds optional sbom-flags input to pass custom flags to npm sbom (e.g. --omit dev)
• Hardens SBOM generation and validation steps against command injection by using env: instead of direct ${{ inputs.* }} interpolation in run: blocks

Test plan

• Verify SBOM generation works with no sbom-flags (default behaviour)
• Verify SBOM generation works with custom flags e.g. sbom-flags: '--omit dev'

[github-actions]

🛡️ SHA Pinned Actions Report

✅ All 28 file(s) passed — actions are allowed and pinned as required.