github.com/google/osv-scalibr@v0.4.1/extractor/filesystem/sbom/cdx (about) cdx.go cdx_test.go metadata purl testdata