[3.12] gh-112302: Move pip SBOM discovery to release-tools (GH-115360)#115486