fix(ci): include node-runtime-worker-thread SBOM in Compass SBOM MONGOSH-1856

[addaleax]

This was previously missed before closing the ticket. Without this, dependencies that end up being bundled in node-runtime-worker-thread are not properly listed in the Compass SBOM.

Description

Checklist

• New tests and/or benchmarks are included
• Documentation is changed or added
• If this change updates the UI, screenshots/videos are added and a design review is requested
• I have signed the MongoDB Contributor License Agreement (https://www.mongodb.com/legal/contributor-agreement)

Motivation and Context

• Bugfix
• New feature
• Dependency update
• Misc

Open Questions

Dependents

Types of changes

• Backport Needed
• Patch (non-breaking change which fixes an issue)
• Minor (non-breaking change which adds functionality)
• Major (fix or feature that would cause existing functionality to change)

[Copilot]

Pull Request Overview

This PR fixes the SBOM (Software Bill of Materials) generation for Compass by including dependencies from the node-runtime-worker-thread package that were previously missing. The change ensures that bundled dependencies in this worker thread package are properly listed in the Compass SBOM.

Key Changes:

• Added logic to copy and merge the node-runtime-worker-thread SBOM data into the main SBOM
• Updated the SBOM generation pipeline to deduplicate entries after merging
• Modified shell script quoting for better compatibility

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}