feat: support wildcards in the sbom input

[somaz94]

Adds glob pattern support to the sbom input. Previously the value was passed
to grype verbatim, so a pattern like */*.cdx.json failed with unable to open file. The input is now expanded with fs.globSync; per the maintainer's note
on the issue, it must resolve to exactly one file, otherwise the action fails
with a clear error.

Uses the Node built-in fs.globSync (runtime is node24), so no new dependency
is added.

Validation:

• npm test (lint + build + tests): 33 tests, 33 pass, 0 fail
• New tests cover glob matching exactly one file (runs), zero files (errors), and multiple files (errors)
• dist/index.js rebuilt via npm run build

Closes #673

[somaz94]

@wagoodman @kzantow @willmurphyscode — friendly ping on this one (adds wildcard support to the sbom input).

Worth flagging that CI has never actually run here: there are zero workflow runs on the head sha, and DCO is the only check. It doesn't look PR-specific — fork PRs opened since late June (#708, #714, #727) also show zero runs, while #686 from May has three, so validations.yaml seems to have stopped dispatching for forks.

Could one of you approve the workflow run so there's a real signal to review against? Happy to rebase if that would help.