github.com/anchore/syft@v1.38.2/syft/format/cyclonedxxml/test-fixtures (about) bad-sbom identify snapshot