Bug: Windows upload skips SBOM sidecars named after the full artifact

[e-q]

sbom.py writes Windows SBOM files beside each artifact using the full artifact
filename plus .spdx.json. For example:

python-3.14.0-amd64.exe.spdx.json

windows-release/merge-and-upload.py currently searches with
Path.with_suffix(".spdx.json"), which maps that artifact to:

python-3.14.0-amd64.spdx.json

As a result, the upload step can skip the SBOM file that was generated for the
artifact.

Expected behavior

The Windows upload step should look for <artifact>.spdx.json and upload that
file next to the artifact.

[sethmlarson]

FYI @zooba, related to Windows release process.

[zooba]

merge_and_upload.py is only for the PyManager packages, it doesn't do anything with the legacy ones.