dependabot: cover .github/sbom so the pinned SBOM generator gets updates #368

Follow-up from #362.

The Supply Chain workflow installs its pinned SBOM generator (@cyclonedx/cdxgen 12.8.5, plus an undici override for three high-severity advisories) from .github/sbom/package.json / package-lock.json. .github/dependabot.yml doesn't cover that directory, so the generator, its transitive dependencies and the undici override never get update PRs. New advisories against them only show up when Dependency Review or a manual audit happens to catch them.

Fix: add an npm ecosystem entry for directory: "/.github/sbom" to .github/dependabot.yml (weekly, grouped). Once a patched cdxgen ships its own fixed undici, revisit whether the override is still needed.