Harden queued credentials and supply chain evidence

[VirtuArchitect]

Summary

• reject inline BMC username/password payloads for queued inventory and virtual-media jobs unless a credential_ref or configured secret provider is used
• add regression coverage for queued credential rejection and credential_ref acceptance
• add pip audit floor plus CI wheel build, CycloneDX SBOM generation, SBOM artifact upload, and GitHub SBOM attestation
• update operator/security documentation for queued credential handling and supply-chain evidence

Verification

• python -m pytest tests\test_store_jobs.py tests\test_api.py -q
• python -m pytest -q
• python -m pip_audit --skip-editable
• python -m bandit -r src --severity-level medium
• docker compose config --quiet
• python -m build --wheel
• python -m cyclonedx_py environment --output-format JSON --output-file sbom.cdx.json
• git diff --check