Exclude qa sbom fixtures from dependency scanning

There are fixtures under several qa directories with gl-sbom
artifacts. If not excluded, they will appear in the vulnerability
report.

Changelog: other