fix: reduce SBOM report artifact volume

[mfahlandt]

Problem

The reporting changes stopped the GitHub summary page from exploding, but each matrix job still uploaded its own report artifact. On large runs this leaves the workflow with ~2000 artifacts, which makes the Actions UI hard to use.

A second issue is that jobs can legitimately generate nothing in recent mode or when an SBOM already exists, and that should not fail reporting.

Fix

• write report JSON into a visible report-artifacts/ directory
• do not fail when a job has no report files to upload
• merge per-repository report artifacts into a small number of batch artifacts with actions/upload-artifact/merge@v4
• delete the original per-repository artifacts after merge
• make the final summary job download only the merged batch artifacts and collect JSON files recursively

This reduces the visible artifact count from thousands down to roughly one CNCF batch artifact, up to eight subproject batch artifacts, and the final consolidated report artifact.

Signed-off-by: Mario Fahlandt mfahlandt@pixel-haufen.de