HBASE-27876 Only generate SBOM when releasing (apache#5251)

Move CycloneDX plugin to profile section

Signed-off-by: Duo Zhang <zhangduo@apache.org>
(cherry picked from commit 256e5e9)
(cherry picked from commit 53a637d)
Change-Id: If2c1f63673cc0d98af84135b45e43fbf42665307

pom.xml

@@ -2396,19 +2396,6 @@
           </formats>
         </configuration>
       </plugin>
-      <plugin>
-        <groupId>org.cyclonedx</groupId>
-        <artifactId>cyclonedx-maven-plugin</artifactId>
-        <version>2.7.6</version>
-        <executions>
-          <execution>
-            <goals>
-              <goal>makeBom</goal>
-            </goals>
-            <phase>package</phase>
-          </execution>
-        </executions>
-      </plugin>
     </plugins>
     <extensions>
       <extension>
@@ -3020,6 +3007,19 @@
               </dependency>
             </dependencies>
           </plugin>
+          <plugin>
+            <groupId>org.cyclonedx</groupId>
+            <artifactId>cyclonedx-maven-plugin</artifactId>
+            <version>2.7.6</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>makeBom</goal>
+                </goals>
+                <phase>package</phase>
+              </execution>
+            </executions>
+          </plugin>
         </plugins>
       </build>
     </profile>