Use `cargo-auditable` to embed SBOM data into official `cgx` binaries

[anelson]

The space overhead is low, and for users who employ automated tooling like trivy this should Just Work (tm).

[anelson]

Sadly I've had to revert the change to use cargo-auditable and re-open this issue for the time being, as cargo-auditable seems not to publish aarch binaries and the release workflow generated by cargo-dist doesn't seem to know about this and just skip installing cargo-auditable.

[anelson]

See rust-secure-code/cargo-auditable#230 and axodotdev/cargo-dist#2190.

cargo-auditable has already changed its dist config to produce ARM64 Linux and Windows binaries. Once a new release is created, this can be re-enabled.

[anelson]

I made another attempt at this, since cargo-auditable started to produce ARM64 binaries. Unfortunately, since the last attempt, we now build aarch64 musl binaries as well, so I ran into an issue rust-secure-code/cargo-auditable#249. I submitted a PR rust-secure-code/cargo-auditable#250 which has landed, but until the next cargo-auditable release the binaries won't be part of the release, so this needs to wait a bit longer.

[anelson]

Update: five days ago a new release of cargo-auditable finally came out, so there are now aarch64 binaries available. It should be possible to implement this now!