Use maturin's SBOM feature to track vendored Rust crates

[tiran]

maturin build backend can now generate SBOMs for all Python packages that use Maturin, see https://www.maturin.rs/sbom.html . It covers the waste majority of Python packages with a Rust component. Some packages may still use setuptools-rust, though.