ci(sbom): check out submodules recursively in PR license check

The PR-time SBOM license check was using `submodules: false`, so when
generate_sbom.py ran the new submodule directory was empty. The script
treats uninitialized submodules as `(not checked out) -> NOASSERTION
(skipped)` rather than a failure, which let PR #27184 (adding
PX4-OpticalFlow as a submodule) pass without ever inspecting the actual
repo for a LICENSE file. The monthly audit then caught it (#27217)
because it uses `submodules: recursive`.

Switch the PR-time job to `submodules: recursive` so license issues
are caught at PR time rather than on the next monthly audit. The job
only runs when .gitmodules, license-overrides.yaml, or
generate_sbom.py change, so the extra clone cost is bounded.

Signed-off-by: Ramon Roche <mrpollo@gmail.com>

.github/workflows/sbom_license_check.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 1
-          submodules: false
+          submodules: recursive
 
       - name: Install PyYAML
         run: pip install pyyaml --break-system-packages