ci(release): fix CycloneDX SBOM generation (cargo-cyclonedx has no -p flag) (#79)

cargo-cyclonedx 0.5.9 walks the whole workspace in a single pass and
writes a <package>.cdx.json next to each member's Cargo.toml; it has no
-p/--package selector. The previous three 'cargo cyclonedx ... -p <crate>'
invocations aborted with 'error: unexpected argument -p found', failing
the cargo-publish job after the crates were already published and, in
turn, skipping the github-release attach-assets job (it needs all four
publish jobs). v0.3.0 published to every registry but got no GitHub
Release page or SBOM assets as a result.

Replace the three invalid calls with a single workspace pass and copy
the three crates.io crate SBOMs into the upload dir.

.github/workflows/release.yml

@@ -90,11 +90,15 @@ jobs:
 
       - name: Generate CycloneDX SBOMs
         run: |
-          cargo cyclonedx --format json --top-level -p wickra-core
-          cargo cyclonedx --format json --top-level -p wickra-data
-          cargo cyclonedx --format json --top-level -p wickra
+          # cargo-cyclonedx walks the whole workspace in a single pass and
+          # writes a <package>.cdx.json next to each member's Cargo.toml; it
+          # has no -p/--package selector. Collect the three crates.io crates
+          # (the .crate files published by this job) into the upload dir.
+          cargo cyclonedx --format json --top-level
           mkdir -p sboms
-          find . -name "*.cdx.json" -not -path "./target/*" -exec cp {} sboms/ \;
+          cp crates/wickra-core/wickra-core.cdx.json sboms/
+          cp crates/wickra-data/wickra-data.cdx.json sboms/
+          cp crates/wickra/wickra.cdx.json sboms/
           ls -lh sboms/
 
       - name: Upload SBOMs