Cloud Security: document the SBOM route as GET /code/sbom?repo=

[maximelb]

What

Documents the Code Security SBOM export route in its new form:

• before: GET /code/repos/{repo}/sbom
• after: GET /code/sbom?repo=<owner>/<name> (optional provider)

Updates the route table in cloud-security/code-security/reference.md and the Code Security row in cloud-security/api-reference.md. The CLI command (limacharlie cloudsec code sbom --repo ...) doesn't change.

Compatibility window

The API gateway change behind this route is merged but not yet released to production. Until the next API release, production still serves only the old path, so these two lines describe a route that isn't live yet. The route has no known direct users, so this short window is accepted.

🤖 Generated with Claude Code

[maximelb]

Self-review (adversarial, from a pristine git archive of the head):

• A search of docs/ found no other mention of the old route. The CLI examples (limacharlie cloudsec code sbom --repo ...) don't change.
• The route table row now names the required repo parameter and the optional provider, which matches the gateway's OpenAPI for the new route.
• Known window: until the next API release, production serves only the old route. Accepted, because the route has no known users.
  No open issues.