github.com/anchore/syft@v1.38.2/syft/format/cyclonedxjson/test-fixtures (about) bad-sbom identify snapshot