Add dependency graph SBOM export and submission functions [Changelog 2023-03-28] #621

Summary

The dependency graph has no coverage in this module — there is no way to export a repository's SBOM (Software Bill of Materials) or submit dependency snapshots. The dependency graph REST API exposes an SBOM export endpoint (SPDX) and a dependency submission endpoint, both valuable for supply-chain compliance automation.

Changelog reference

• 2023-03-28 — Generate an SBOM from the dependency graph: export a repository's dependency graph as an SPDX 2.3 SBOM; the changelog notes "A supporting REST API to generate SBOMs for repositories will be available in the coming weeks."

Desired capability

Add functions for the dependency graph REST API:

• Export-GitHubDependencySBOM (GET /repos/{owner}/{repo}/dependency-graph/sbom) — export the SBOM as an object/JSON, with optional -Path to write the file.
• Get-GitHubDependencyGraphCompare (GET .../dependency-graph/compare/{basehead}) — diff dependencies between two commits/refs.
• Submit-GitHubDependencySnapshot (POST .../dependency-graph/snapshots) — submit a dependency snapshot from a build.

Acceptance criteria

• Functions use Invoke-GitHubAPI and the active GitHubContext.
• SBOM export returns a typed object and optionally writes a .spdx.json file.
• Integration tests against an owned repo (skipped gracefully where dependency graph is unavailable).

Notes

• SBOM export is available to anyone with read access; dependency submission requires write access.
• Consider that SBOM exports are now computed asynchronously (see 2026-04-14 changelog) — the function should handle the async/202 response shape.