make SBOM creation optional

This adds a new input, sbom, to make SBOM creation optional. It preserves the default of creating one with trivy.

(The motivation for this is that buildah is crashing when it tries to run trivy. Which might be an upstream buildah bug, but in the meantime I figure I can skip it or at least put it in a separate step to make it easier to debug.)