Publish sbom along with other artifacts

[raboof]

This produces artifact names consistent with the Maven plugin, e.g. pekko-actor_2.13-cylonedx.xml

Implements #54

I'd have liked to add a scripted test, but it seems scripted doesn't allow referring to '$HOME' or '~' for checking files have been created.

[mdedetrich]

I think it makes sense to merge https://github.com/sbt/sbt-sbom/pull/63 before this PR so you can get all of the formatting updates as well