Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/assets/authority/authority-plugin-bootstrap-sequence.mmd

@@ -0,0 +1,20 @@
+%% Standard plug-in bootstrap sequence (Mermaid)
+sequenceDiagram
+    autonumber
+    participant Operator as Operator / DevOps
+    participant Host as Authority Host
+    participant Registrar as StandardPluginRegistrar
+    participant Store as Credential Store
+    participant Audit as Audit Sink
+    participant Telemetry as Telemetry Pipeline
+
+    Operator->>Host: Deploy plugin manifest + offline secrets bundle
+    Host->>Registrar: Load options + validate capabilities
+    Registrar->>Store: Ensure collections + indexes
+    Registrar->>Store: Seed bootstrap principals (hashed passwords, roles)
+    Store-->>Registrar: Acknowledge deterministic bootstrap state
+    Registrar-->>Host: Register IIdentityProviderPlugin + capability metadata
+    Host->>Registrar: Invoke WarmupAsync (health checks, secret validation)
+    Registrar->>Audit: Emit authority.plugin.load event
+    Registrar->>Telemetry: Emit structured logs and counters
+    Host-->>Operator: Report readiness (plugin lifecycle complete)