integrate sbom generation and upload into CI