fix(release): update SBOM path to build/reports/cyclonedx/bom.json

CycloneDX Gradle plugin 3.x changed the output directory from
build/reports/ to build/reports/cyclonedx/ (cyclonedxDirectBom task).

Author: leogalambos

.github/workflows/release.yml

@@ -76,17 +76,6 @@ jobs:
       # Publish release
       # The tag name is release@x.y.z; strip the prefix to get the plain version.
       # -----------------------------------------------------------------------
-      - name: Locate SBOM
-        run: |
-          BOM=$(find build -name "bom.json" | head -1)
-          if [ -z "$BOM" ]; then
-            echo "bom.json not found; available BOM files:"
-            find build -name "bom*" || true
-            exit 1
-          fi
-          echo "BOM_PATH=$BOM" >> "$GITHUB_ENV"
-          echo "Located SBOM: $BOM"
-
       - name: Publish GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -97,4 +86,4 @@ jobs:
             --notes-file /tmp/CHANGELOG_RELEASE.md \
             build/distributions/*.zip \
             build/distributions/*.tar \
-            "$BOM_PATH"
+            build/reports/cyclonedx/bom.json