chore: untrack sbom.cdx.json — it is a published artifact, not source (#168)

.gitignore has listed sbom.cdx.json since line 102, but the file was already
tracked when the rule landed, and gitignore does not apply to tracked files.
So the template shipped a committed SBOM that the same repo declares should
never be committed, and every app scaffolded from it inherited the file.

The SBOM is generated per run by the shared quality workflow, published as
the sbom-<app> artifact and attached to stable releases. A committed copy is
stale the moment a lockfile moves. This one dated from the template's own
scaffold and had not been regenerated since.

Refs ConductionNL/.github#572, ConductionNL/hydra#617

Author: rubenvdlinde