security/py-lib4sbom: Update 0.8.7 => 0.9.4

Fixes and features:

• improved service component processing for CycloneDX
• convert sbom types between SPDX and CycloneDX
• update licence list
• distributionConstraints
• default licence type
• update suported Python version
• add SBOM validation debug
• Invalid CycloneDX SHA algorithm specified (fixes #73)
• add support for CycloneDX 1.7
• add support for parsing SPDX documents in in-toto statements
• optimised CycloneDX JSON schema validation
• CycloneDX validation fails (fixes #70)
• detect CBOM

https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.8.8
https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.9.0
https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.9.1
https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.9.2
https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.9.3
https://github.com/anthonyharrison/lib4sbom/releases/tag/v0.9.4

While here:

• Lowercase "yes" in NO_ARCH.
• Merge MVs in post-patch.

PR: 293084