Correct the SBOM workflow/config

[dimaqq]

Introduced in #731:

pebble/.sbomber-manifest-snap.yaml

Lines 12 to 15 in d2838bb

	ssdlc_params:
	name: 'pebble'
	version: '' # auto-detect
	channel: 'stable'

On push to master, pebble snap is pushed to latest/edge.
One release, the snap is pushed to latest/candidate.

As far as I know, candidate is promoted to stable manually (seems undocumented, cc @benhoyt).
Which means that the workflow .github/workflows/sbom-secscan.yaml automated via on: push: tags: ["v*"] won't see the newest release.

The current work-around is to run the workflow manually via on: workflow_dispatch:.

[dimaqq]

cc @james-garner-canonical who made #731

[tonyandrewmeyer]

There's also a race condition. The sbomber tool downloads the snap from the store and so you get the wrong results. If the right channel is used, maybe this is ok, but I wonder if it will be available quickly enough (I had concerns about this with the Python libraries too). We may need to use the local file system rather than relying on getting it from the store.

[james-garner-canonical]

Using the local files makes sense to me. I guess from a security perspective maybe it's preferred to analyse the actual published artefact? But if we're trusting (e.g. via attestations) that the published version matches our local files, it seems fine.