Fix apko build by removing read-only mount on work directory

apko now writes SBOM files next to the config YAML, so the work
directory must be writable.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -103,7 +103,7 @@ jobs:
               echo "::group::Building apko base: $VARIANT ($ARCH)"
               mkdir -p ${{ github.workspace }}/build-${ARCH}/${VARIANT}
               docker run --rm \
-                -v ${{ github.workspace }}/apko:/work:ro \
+                -v ${{ github.workspace }}/apko:/work \
                 -v ${{ github.workspace }}/build-${ARCH}/${VARIANT}:/output \
                 cgr.dev/chainguard/apko build \
                   --arch $ARCH /work/${VARIANT}.yaml ${VARIANT}:latest /output/rootfs.tar.gz