minor: add sbom and vex on security page

[aethernet]

https://balena.fibery.io/Work/Project/balenaos-SBOM-as-release-asset-1515

---

Please make sure to read the CONTRIBUTING document before opening the PR for relevant information on contributing to the documentation. Thanks!

[Copilot]

Pull Request Overview

This PR adds documentation for BalenaOS Software Bill of Materials (SBOM) and Vulnerability EXchange (VEX) files to the security page.

• Introduces a new SBOM and VEX section explaining file formats and usage.
• Describes how to find bom.json and vex.json assets for releases.
• Mentions compatibility with the CycloneDX tooling ecosystem.

Comments suppressed due to low confidence (3)

pages/learn/welcome/security.md:93

• Rephrase this sentence for clarity and correct style: use parentheses or em dashes consistently, capitalize JSON, remove the extra ‘the’, and simplify phrasing. E.g., "BalenaOS provides a Software Bill of Materials (SBOM) in the machine-readable, human-friendly CycloneDX 1.4 JSON format, which lists all components that compose the OS and their fixed vulnerabilities."

BalenaOS provides Software Bill of Materials (SBOM) in the - machine readable, but human friendly - CycloneDX 1.4 json format. Those files can be used to determine the versions of the all the components that composes the OS, and the known fixed vulnerabilities.

pages/learn/welcome/security.md:99

• There's an unmatched closing parenthesis at the end. Remove the extra ) or adjust punctuation so the parentheses enclose only the intended fragment.

`bom.json` and `vex.json` files can be found in the asset list of an OS release page (under the `cyclonedx` folder); click the `HOST OS VERSION` of a device to go to that page).

pages/learn/welcome/security.md:101

• This is a run-on sentence. Consider splitting into two sentences or using a semicolon after “analysis” for clearer separation of clauses.

SBOM and VEX are compatible with the cyclonedx ecosystem of software composition analysis, a list of tools (open-source and proprietary) can be found on [cyclonedx.org tool center](https://cyclonedx.org/tool-center/).