CycloneDX version matrix generation is cyclonedx-npm only for npm? the trigger for the GH actions should react to the 'release' event only (?)