Generate SBOM from complete dependency graphs and license evidence

[KeyffMS]

What changed

• traverse every package in application and test project.assets.json libraries and every package dependency edge in targets;
• classify direct/transitive, application/test/build and shipped scopes independently of the handwritten policy;
• use [Legal/.NET] Generate exact-version THIRD-PARTY-NOTICES for self-contained builds #83 component coverage as the authority for packages embedded in SightAdapt.exe or shipped as loose binaries;
• collect exact NuGet package SHA-512, .nuspec SHA-256, declared license metadata, packaged-license hashes, repository URLs/commits and authors;
• make dependency policy schema 2 an allow/deny/review and override layer rather than the inventory source;
• generate schema-2 LICENSE-REPORT.json, DEPENDENCIES.md and SPDX 2.3 from one component graph;
• use scope-aware SPDX root relationships: shipped DEPENDS_ON, test TEST_DEPENDENCY_OF, build BUILD_DEPENDENCY_OF;
• retain package-to-package dependency edges from both restore graphs;
• add a negative fixture containing an unknown-license transitive package that must fail CI;
• validate evidence, package counts and SPDX relationship semantics in the final compliance gate;
• retain both application and test restore graphs in CI diagnostics.

Root cause

The previous generator enumerated direct references, framework download dependencies and Actions, but did not traverse the complete libraries/targets restore graphs. Its license result primarily repeated manually reviewed policy data, and build/test dependencies were represented as runtime SightAdapt DEPENDS_ON relationships.

Verified result

GitHub Actions run 30541728349 produced a passing schema-2 report and SPDX 2.3 document:

• 25 components total;
• 16 transitive components;
• 17 restore-graph dependency edges;
• 4 shipped packages/components, including SightAdapt;
• 6 application-graph packages and 16 test-graph packages;
• 21 MIT conclusions, 3 Microsoft .NET distribution conclusions and 1 Windows SDK custom conclusion;
• 25 SPDX packages, 16 packaged files and 58 relationships;
• relationship types: 20 DEPENDS_ON, 15 TEST_DEPENDENCY_OF, 6 BUILD_DEPENDENCY_OF, 16 CONTAINS, 1 DESCRIBES;
• final archive SHA-256 7B178A42167B80F606D137A1AEEF734972A71363BB5166F4B0169761F34DFDBF;
• final compliance result pass.

The full graph found two policy corrections from exact metadata:

• Microsoft.AspNetCore.App.Runtime.win-x64/8.0.29 declares MIT and is application-build/restore-only, not shipped;
• transitive System.Reflection.Metadata/1.6.0 uses legacy license-URL metadata and is concluded as MIT through a version-specific reviewed override.

The negative fixture Unknown.Transitive/1.0.0 was rejected specifically because it had no resolved license.

Scope

Supply-chain inventory, license evidence, release validation and documentation only. Application behavior is unchanged.

Closes #85.