Upload Windows SBOM sidecars named after full artifacts

[e-q]

Summary

• look for Windows SBOM sidecars as <artifact>.spdx.json
• place SBOM uploads next to the corresponding artifact destination
• add a focused test for Windows upload calculation

Closes #399

Tests

• Focused pytest coverage for Windows upload calculation: passed.
• Ruff lint and format checks on touched files: passed.
• Direct repository mypy check through an existing mypy environment: passed.
• Whitespace check: passed.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.