Bug: Windows upload skips SBOM sidecars named after the full artifact

[e-q]

sbom.py writes Windows SBOM files beside each artifact using the full artifact
filename plus .spdx.json. For example:

python-3.14.0-amd64.exe.spdx.json

windows-release/merge-and-upload.py currently searches with
Path.with_suffix(".spdx.json"), which maps that artifact to:

python-3.14.0-amd64.spdx.json

As a result, the upload step can skip the SBOM file that was generated for the
artifact.

Expected behavior

The Windows upload step should look for <artifact>.spdx.json and upload that
file next to the artifact.

[sethmlarson]

FYI @zooba, related to Windows release process.

[zooba]

merge_and_upload.py is only for the PyManager packages, it doesn't do anything with the legacy ones.

[e-q]

@zooba Would you agree that there is still a bug here for the PyManager package ZIP path?

The PyManager layout step creates SBOMs for package ZIPs as <artifact>.spdx.json, while merge-and-upload.py appears to look for src.with_suffix(".spdx.json"), which would map python-...-amd64.zip to python-...-amd64.spdx.json instead of python-...-amd64.zip.spdx.json.

If that interpretation is right, I can update #404 so the example/test is PyManager-specific rather than using a legacy installer example.

[zooba]

Oh I see, it's removing the .zip when it shouldn't be.

Just replace the .with_suffix(".spdx.json") with .with_name(f"{src.name}.spdx.json") and skip the test. This script changes so infrequently and is single-purpose, so it isn't going to benefit from a bigger harness or any refactoring. Let's just make it correct.