cachi2: fix testing submodules sbom

[MartinBasti]

SBOMs should be checked in remote_surce workdir, they are nt supposed to be in injected dir

Maintainers will complete the following section

• [ ] Commit messages are descriptive enough
• [ ] Code coverage from testing does not decrease and new code is covered
• [ ] Python type annotations added to new code
• [ ] JSON/YAML configuration changes are updated in the relevant schema
• [ ] Changes to metadata also update the documentation for the metadata
• [ ] Pull request has a link to an osbs-docs PR for user documentation updates
• [ ] New feature can be disabled from a configuration file