Add the sha1 attribution to the qscxmlc SBOM

src/3rdparty/sha1/qt_attribution.json was not referenced by any CMake
target, even though scxmlcppdumper.cpp includes sha1.cpp directly.

Pick-to: 6.8 6.11 6.12 6.12.0
Change-Id: I406faacc78be5d409ba4fe4726a5d2db045a5245
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>