Cloak SBA Binaries in `allowed-sb-binaries.txt`

We've historically allowed [SBA binaries](https://github.com/dotnet/dotnet/blob/d4d78458ac3108a3e5f8ae0b02156baa6060969e/eng/allowed-sb-binaries.txt#L57-L61) in the VMR, possibly due to technical constraints around cloaking binaries that came from submodules. It probably makes sense to revisit that decision and cloak them now instead.