Publish sbom along with other artifacts

[raboof]

I'd have liked to add a scripted test, but it seems scripted doesn't allow referring to '$HOME' or '~' for checking files have been created.

Implements #54