Fix base-lint staticcheck SA5011 in sbom-builder tests

[Copilot]

The base-lint GitHub Actions job failed in lint-go-tools due to staticcheck (SA5011) reporting possible nil dereferences in tools/sbom-builder/main_test.go. This update makes the nil-guard control flow explicit so the test code passes static analysis.

• Root cause in test assertions

  • findPackage(...) results were nil-checked with t.Fatalf(...), but staticcheck still flagged subsequent field access as potentially unsafe.

• Targeted test-only control-flow fix

  • Added explicit return immediately after the two t.Fatalf(...) nil checks:
    • TestAddOSPackage_AddsSiblingWithRefs
    • TestAddGoModulePackage
  • No production code or runtime behavior changes.

• Illustrative diff pattern

  if goPkg == nil {
      t.Fatalf("expected Package-go-siderolabs-talos to be added, got: %v", packageIDs(doc))
      return
  }