github.com/devseccon/trivy@v0.47.1-0.20231123133102-bd902a0bd996/pkg/fanal/artifact/sbom/testdata (about) bom.json os-only-bom.json sbom.cdx.intoto.jsonl