fix(build): include go package licenses in sbom fixes#2363 (#2364)

Signed-off-by: Victoria <[email protected]>

Author: kaysavps

.github/workflows/release.yaml

@@ -106,6 +106,8 @@ jobs:
 
       - name: Generate SBOMs, upload to release and attest
         id: attest_goreleaser
+        env:
+          SYFT_GOLANG_SEARCH_REMOTE_LICENSES: "true"
         run: |
           # goreleaser output resides in dist/artifacts.json
           # Attest all built containers and manifests