Add support for hosting SPDX-2 SBOMs alongside release artifacts

[sethmlarson]

Part 1 of #2339

I modeled this PR off of the Sigstore bundle PR since it's a very similar approach.

There may be more than one SBOM per artifact eventually (for multiple reasons, either users demanding CycloneDX or a new major version of SPDX) so accounting for that possibility by using spdx2 as the prefix for the database field.

I don't know what the "admin" interface needs to look like for release managers to be able to submit SBOM files for new releases, this might already be enough if Sigstore bundles are doable today.

[hugovk]

Updating from main should fix the Read the Docs build.

[sethmlarson]

@hugovk Thanks Hugo! I've rebased on main.

[sethmlarson]

Okay I believe that by adding the sbom_spdx2_file field to ReleaseFileResource is enough to add support for uploading via API. This will require a change in python/release-tools#82 once it's available here.