fix(sbom): use absolute paths for bazel run invocation

bazel run changes working directory before executing the binary, so
relative paths to bazel-bin artifacts are not found. Use $GITHUB_WORKSPACE
to construct absolute paths for input/output files.

Author: Lukasz-Juranek

.github/workflows/generate_sbom.yml

@@ -78,8 +78,8 @@ jobs:
       - name: Convert SPDX to GitHub Dependency snapshot
         run: |
           bazel run @score_sbom//scripts:spdx_to_github_snapshot_bin -- \
-            --input bazel-bin/reference_integration_sbom.spdx.json \
-            --output snapshot.json \
+            --input "$GITHUB_WORKSPACE/bazel-bin/reference_integration_sbom.spdx.json" \
+            --output "$GITHUB_WORKSPACE/snapshot.json" \
             --sha "${{ github.sha }}" \
             --ref "${{ github.ref }}" \
             --job-correlator "generate-sbom" \
@@ -90,7 +90,7 @@ jobs:
         with:
           script: |
             const fs = require('fs');
-            const snapshot = JSON.parse(fs.readFileSync('snapshot.json', 'utf8'));
+            const snapshot = JSON.parse(fs.readFileSync(process.env.GITHUB_WORKSPACE + '/snapshot.json', 'utf8'));
             await github.rest.dependencyGraph.createRepositorySnapshot({
               owner: context.repo.owner,
               repo: context.repo.repo,