sbom: build each cross-target SBOM for the target its config selects

The cross_targets matrix lists config file names, and the step passed the
same string as TARGET. For four of the seven entries that is not the
target the config selects: nrf52840.config sets TARGET=nrf52,
imx-rt1060.config sets imx_rt, nxp-t1040.config sets nxp_t1040, and
renesas-rx65n.config sets rx65n.

TARGET on the command line beats the config, so the build asked for
hal/nrf52840.o, whose source does not exist. SBOM_SRCS filters the source
list through $(wildcard), which dropped it, and the job stayed green
while publishing an SBOM for a bootloader with no target HAL at all:
29 sources, hal.c present, nrf52.c absent.

Drop the TARGET override and let the config decide, which is what the
documented invocation already does. nrf52840 now records 30 sources with
hal/nrf52.c among them, and the document is named for the real target.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>

.github/workflows/test-sbom.yml

@@ -276,7 +276,13 @@ jobs:
         #   imx-rt1060 Arm Cortex-M7     sama5d3   Arm Cortex-A5
         #   nxp-t1040 PowerPC e5500      renesas-rx65n  Renesas RX
         #   hifive1   RISC-V
-        target:
+        #
+        # These are config file names, which are not always the TARGET the file
+        # selects: nrf52840.config sets TARGET=nrf52, imx-rt1060.config sets
+        # imx_rt, nxp-t1040.config sets nxp_t1040, renesas-rx65n.config sets
+        # rx65n. The config is the only source of truth, so the step below does
+        # not pass TARGET at all.
+        config:
           - stm32h7
           - nrf52840
           - imx-rt1060
@@ -301,10 +307,15 @@ jobs:
       - name: Verify vendored gen-sbom
         run: test -f tools/sbom/gen-sbom
 
+      # No TARGET= here on purpose. The config file sets it, and passing the
+      # config file name instead selects a HAL that does not exist: TARGET=
+      # nrf52840 asks for hal/nrf52840.c, which is really hal/nrf52.c, and the
+      # SBOM then described this bootloader with no target HAL at all (29
+      # sources, hal.c but no nrf52.c) while CI stayed green.
       - name: make sbom (no cross-toolchain present)
         run: |
-          cp config/examples/${{ matrix.target }}.config .config
+          cp config/examples/${{ matrix.config }}.config .config
-          make sbom TARGET=${{ matrix.target }}
+          make sbom
           python3 tools/sbom/validate_sbom.py \
             --name-prefix wolfboot --min-properties 20 \
             wolfboot-*.cdx.json wolfboot-*.spdx.json
@@ -313,7 +324,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: wolfboot-sbom-${{ matrix.target }}
+          name: wolfboot-sbom-${{ matrix.config }}
           path: |
             wolfboot-*.cdx.json
             wolfboot-*.spdx.json