Bump anchore/sbom-action/download-syft in the github-actions group (#21)

Bumps the github-actions group with 1 update: [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action).


Updates `anchore/sbom-action/download-syft` from 0.24.1 to 0.24.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@aa80c8c...3ad7283)

---
updated-dependencies:
- dependency-name: anchore/sbom-action/download-syft
  dependency-version: 0.24.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/ci.yml

@@ -239,7 +239,7 @@ jobs:
 
       # Both are called by GoReleaser itself: syft for the `sboms` section,
       # cosign for the `signs` one. They have to be on PATH before it runs.
-      - uses: anchore/sbom-action/download-syft@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1
+      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       # The checkout leaves the tag as a plain pointer at the commit; the