ci: don't generate sboms on forks

[terriko]

Description

Currently, I'm getting a bunch of messages saying that sbom generation failed on a few people's forks. I suspect that we need to change the workflow file so that it only runs the sbom updates on the main repo.

Version/platform info

Running in any particular CI environment we should know about? Github Actions

[terriko]

Took a quick look at this to fill in enough info to mark it as beginner friendly.

The changes will need to go into the update sbom workflow config, which can be found here: https://github.com/intel/cve-bin-tool/blob/main/.github/workflows/sbom.yml

To run something only on the main repo you can use the following logic:

if: github.repository == 'intel/cve-bin-tool'

You can see how that works in the update-cache job here: https://github.com/intel/cve-bin-tool/blob/main/.github/workflows/update-cache.yml

So basically, edit the sbom.yml file to include that if line in the appropriate place, similar to what you find in update-cache.yml.

[terriko]

And because I marked this as a good first issue, here's the new contributor tips:

Short tips for new contributors:

• cve-bin-tool's contributor docs
• If you've contributed to open source but not this project, you might just want our checklist for a great pull request
• cve-bin-tool uses https://www.conventionalcommits.org/ style for commit messages, and we have a test that checks the title of your pull request (PR). A good potential title for this one is in the title of this issue.
• You can make an issue auto close by including a comment "fixes #ISSUENUMBER" in your PR comments where ISSUENUMBER is the actual number of the issue. This "links" the issue to the pull request.

Claiming issues:

• You do not need to have an issue assigned to you before you work on it. To "claim" an issue either make a linked pull request or comment on the issue saying you'll be working on it.
• If someone else has already commented or opened a pull request, assume it is claimed and find another issue to work on.
• If it's been more than 1 week without progress, you can ask in a comment if the claimant is still working on it before claiming it yourself (give them at least 3 days to respond before assuming they have moved on).

[rudrakshkarpe]

I look forward to work on this issue!