Attach an SBOM with release assets

**What would you like to be added**:
This was being done, but a change to the release process caused this to stop working.

**Why is this needed**:
Syft is an SBOM generator, it should provide an SBOM of its own releases.

**Additional context**:
The `sbom-action` only triggers release uploads when running in the context of a release, or when a tag is pushed. This is no longer how the release process works, so we'll need to figure out either how to update `sbom-action` or generate and upload an SBOM in a different way.

Start by reviewing the current release process and how sbom-action handles release uploads or tag pushes. Done means Syft releases consistently include an SBOM asset despite the changed release flow.

Written by the indexing model from the issue text.