feat: add configurable HTTP timeout for uploads

[alexanderbsingh]

• Add a configurable --http-timeout option for SBOM uploads
• Default HTTP requests to a 30-second timeout
• Cancel CLI operations gracefully when interrupted
• Document the new option in the README

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

internal/bifrost/sbom_upload.go:173

• On context cancellation, this returns immediately but does not actually stop the background io.Copy; the goroutine can remain blocked reading from stdin (and may keep running after the temp file is closed). This can leak goroutines and keep consuming stdin data in non-terminating contexts (e.g., unit tests or if this code is reused outside the top-level CLI).

	select {
	case err := <-done:
		return err
	case <-ctx.Done():
		return ctx.Err()

internal/bifrost/sbom_upload.go:161

• This comment currently assumes cancellation only happens during process termination, but this helper is also used in unit tests and may be reused in other contexts. Updating the doc comment to match the actual behavior (and the cancellation strategy) will prevent confusion.

// copyStdinWithContext copies stdin into destination and returns promptly when
// ctx is cancelled. ctx is the process signal context (Ctrl+C or SIGTERM), so a
// cancelled copy always means the process is terminating; the io.Copy goroutine
// outlives cancellation only until the process exits moments later.