Poison infra is not scanning the SDK tarball

[NikolaMilosavljevic]

While investigating a poison issue I've noticed that AssetToCheck (https://github.com/dotnet/sdk/blob/5fcddd161b969f850684c2f9765acd4a129591a6/src/SourceBuild/content/eng/finish-source-only.proj#L132) item group does not include the sdk tarball.

ReportPoisonUsage target should depend on CopySdkArchive target.

Note that this will cause the build failure as new poisons will be discovered.

Relevant infra should be updated to prevent this type of regressions.