cloudsec: request a repository SBOM with GET code/sbom?repo=

[maximelb]

What

The Code Security SBOM export route moves from a repository key in the path to a query parameter:

• before: GET /v1/cloudsec/{oid}/code/repos/{owner%2Fname}/sbom
• after: GET /v1/cloudsec/{oid}/code/sbom?repo=<owner/name>[&provider=...]

CloudSec.get_code_sbom() and download_code_sbom() keep their signatures, and limacharlie cloudsec code sbom works as before. Only the request they send changes. The docstring now also lists the no_sbom_for_this_repository reason.

Compatibility window

The API gateway change that serves the new route is merged but not yet released to production. Until the next API release, production still serves only the old path, so this SDK's code sbom gets a 404 there. The old route has no known users, so this short window is accepted. Nothing else in the SDK is affected.

Tests

• test_get_code_sbom_sends_the_key_as_a_query_value: the request goes to code/sbom with repo as a query value.
• test_get_code_sbom_provider: a nested GitLab-style key plus provider are both sent as query values.
• pytest tests/unit/ tests/microbenchmarks/: 4572 passed. The 5 skips are unrelated to this change (platform-only tests, plus two docstring checks that were already skipped).

🤖 Generated with Claude Code

[maximelb]

Self-review (adversarial, from a pristine git archive of the head):

• get_code_sbom sends GET cloudsec/{oid}/code/sbom with repo as the first query pair and provider only when given. urlencode in the client encodes the key's / as %2F inside the query value, and the server decodes it back.
• download_code_sbom and the cloudsec code sbom CLI command both go through get_code_sbom, so neither needs a change. No other SDK path embedded the key in the URL.
• _quote is still used by two other methods, so the import stays.
• Tests: both SBOM tests assert the exact URL and the exact query pairs, so they fail against the old implementation. Full pytest tests/unit/ tests/microbenchmarks/: 4572 passed. The 5 skips are platform-only or were already there.
• Found one gap and fixed it: a CHANGELOG entry (0eea426).
• Known window: until the next API release, production serves only the old route, so code sbom returns 404 there. Accepted, because the route has no known users.
  No open issues.