Move SBOM generation to dist directory for consistency

Co-authored-by: jacksonpradolima <7774063+jacksonpradolima@users.noreply.github.com>

Author: Copilot

.github/workflows/publish.yml

@@ -35,7 +35,7 @@ jobs:
         uses: anchore/sbom-action/download-syft@v0.17.0
 
       - name: Generate SBOM (CycloneDX)
-        run: syft packages dist -o cyclonedx-json=sbom.json
+        run: syft packages dist -o cyclonedx-json=dist/sbom.json
 
       - name: Install sigstore
         run: python -m pip install sigstore==3.5.1
@@ -55,7 +55,7 @@ jobs:
             dist/*.tar.gz.sig
             dist/*.whl.pem
             dist/*.tar.gz.pem
-            sbom.json
+            dist/sbom.json
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0