generate-srcinfo: move to new sbom fixup command

See https://github.com/msys2/msys2-devtools/commit/7459bff72bc688448d3f331ace81fdf4178139fd

.github/workflows/generate-srcinfo.yml

@@ -92,7 +92,7 @@ jobs:
         run: |
           msys2-sbom create srcinfo.json.gz sbom.cdx.json
           ./bin/grype sbom:sbom.cdx.json -o cyclonedx-json=sbom.vuln.cdx.json -o json=sbom.grype.json
-          msys2-sbom merge sbom.cdx.json sbom.vuln.cdx.json --grype-json sbom.grype.json
+          msys2-sbom fixup sbom.vuln.cdx.json --grype-json sbom.grype.json
 
       - uses: actions/upload-artifact@v4
         with: