feat!: rewrite drubom with native PHP inventory, SPDX 3.0.1 export and advisory checks

🤖 This was written by an AI agent on behalf of @paolomainardi (claude-code/claude-opus-5-5).

Rewrites DruBOM so it inventories a Drupal codebase in native PHP, without the Syft or Grype binaries, exports it as SPDX 3.0.1, and checks it against public security advisories only when an administrator enables them.

What changes

• Inventory. Snapshots list Composer packages, Drupal extensions, asset libraries, and npm (lockfile versions 1 to 3), Yarn and pnpm lockfile packages. Anything that cannot be read is listed as a coverage gap. Snapshots are stored in the private file system with configurable retention.
• Advisory checks. Opt-in sources: drupal.org, Packagist and OSV, plus the CISA KEV and ENISA EUVD catalogs to flag known exploited vulnerabilities. Packages from private Composer repositories and private npm registries are never sent. Private npm scopes can be listed in the settings, and a project with npm credentials for the public registry has all its scoped packages treated as private.
• Decisions (VEX). People with the new assess drubom findings permission record whether the site is affected by a finding. A decision applies to the exact package version, must be confirmed after each new snapshot, keeps every revision, can carry a review date, and can be revoked by administrators with a reason.
• SPDX 3.0.1 export. Packages, licenses, dependencies, findings with CVSS severities and known exploited assessments, and decisions as VEX assessments issued by the organization set in the settings. Downloads can leave out extensions that are not enabled. Facts SPDX cannot carry are listed in a loss report.
• Admin UI. Reports > Software inventory: overview, packages, security findings, decisions and snapshots, with filters and paging, a terms page, settings for collectors and sources, and a status report entry.
• Drush. drubom:generate, drubom:analyze, drubom:export, drubom:check (fails CI jobs on open findings or an incomplete inventory, with exit codes), drubom:findings, drubom:decisions, drubom:status, drubom:snapshots and drubom:providers.

Breaking changes

• Requires Drupal 11.3 or later and a private file system. The module also declares compatibility with Drupal 12.
• The Syft and Grype integration is removed. drush updb saves the last stored SBOM and vulnerability report to private://drubom/legacy/ and removes the old settings.
• drubom:sbom-generate, drubom:vuln-scan, drubom:sbom-download and drubom:vuln-sbom-download remain as deprecated aliases. The other Syft, Grype and vulnerability database commands are removed.

Validation

CI passes on Drupal 11 and 12: PHPUnit (unit, kernel, functional and JavaScript), PHPCS, PHPStan, cspell, stylelint, and validation of exported documents against the official SPDX 3.0.1 JSON schema and SHACL shapes. Exports from two large production codebases also pass schema validation.

Closes #3629895