Issue Description

Part of #256

Update artifact retention configuration to include SBOM reports in the compliance tier and verify dependency pinning validation passes for the new actions.

Implementation

1. Update .github/artifact-retention.yml — add sbom_reports to the compliance artifact retention tier (365 days)
2. Update scripts/security/tool-checksums.json — add entries for anchore/sbom-action and actions/attest-sbom if applicable
3. Run Test-DependencyPinning.ps1 — verify the modified workflow passes SHA-pinning validation

SHA References

Acceptance Criteria

• sbom_reports added to compliance tier in .github/artifact-retention.yml
• Test-DependencyPinning.ps1 passes with new actions pinned
• tool-checksums.json updated if applicable

References

• Test-DependencyPinning.ps1