Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/assets/authority/authority-plugin-bootstrap-sequence.svg

@@ -0,0 +1,112 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 360" role="img">
+  <title>Standard plug-in bootstrap sequence</title>
+  <defs>
+    <style>
+      .actor { fill: #1e293b; stroke: #334155; stroke-width: 2; rx: 12; ry: 12; }
+      .actor text { fill: #f8fafc; font: 14px "Segoe UI", sans-serif; }
+      .lifeline { stroke: #475569; stroke-width: 2; stroke-dasharray: 6 6; }
+      .arrow { fill: none; stroke: #38bdf8; stroke-width: 2.5; marker-end: url(#arrow); }
+      .label { fill: #e2e8f0; font: 13px "Segoe UI", sans-serif; }
+      .step { fill: #94a3b8; font: 12px "Segoe UI", sans-serif; }
+    </style>
+    <marker id="arrow" markerWidth="12" markerHeight="12" refX="10" refY="6" orient="auto">
+      <path d="M0,0 L12,6 L0,12 z" fill="#38bdf8" />
+    </marker>
+  </defs>
+
+  <g>
+    <rect class="actor" x="40" y="20" width="140" height="40" />
+    <text x="110" y="45" text-anchor="middle">Operator / DevOps</text>
+    <line class="lifeline" x1="110" y1="60" x2="110" y2="350" />
+  </g>
+
+  <g>
+    <rect class="actor" x="210" y="20" width="140" height="40" />
+    <text x="280" y="45" text-anchor="middle">Authority Host</text>
+    <line class="lifeline" x1="280" y1="60" x2="280" y2="350" />
+  </g>
+
+  <g>
+    <rect class="actor" x="380" y="20" width="150" height="40" />
+    <text x="455" y="45" text-anchor="middle">Standard Registrar</text>
+    <line class="lifeline" x1="455" y1="60" x2="455" y2="350" />
+  </g>
+
+  <g>
+    <rect class="actor" x="560" y="20" width="140" height="40" />
+    <text x="630" y="45" text-anchor="middle">Credential Store</text>
+    <line class="lifeline" x1="630" y1="60" x2="630" y2="350" />
+  </g>
+
+  <g>
+    <rect class="actor" x="720" y="20" width="120" height="40" />
+    <text x="780" y="45" text-anchor="middle">Audit Sink</text>
+    <line class="lifeline" x1="780" y1="60" x2="780" y2="350" />
+  </g>
+
+  <g>
+    <rect class="actor" x="870" y="20" width="120" height="40" />
+    <text x="930" y="45" text-anchor="middle">Telemetry</text>
+    <line class="lifeline" x1="930" y1="60" x2="930" y2="350" />
+  </g>
+
+  <g>
+    <text class="step" x="80" y="90">1</text>
+    <path class="arrow" d="M110 90 H270" />
+    <text class="label" x="190" y="82" text-anchor="middle">Deploy manifest + secrets bundle</text>
+  </g>
+
+  <g>
+    <text class="step" x="250" y="120">2</text>
+    <path class="arrow" d="M280 120 H440" />
+    <text class="label" x="360" y="112" text-anchor="middle">Load options and validate capabilities</text>
+  </g>
+
+  <g>
+    <text class="step" x="420" y="150">3</text>
+    <path class="arrow" d="M455 150 H630" />
+    <text class="label" x="540" y="142" text-anchor="middle">Ensure collections and indexes</text>
+  </g>
+
+  <g>
+    <text class="step" x="420" y="180">4</text>
+    <path class="arrow" d="M455 180 H630" />
+    <text class="label" x="540" y="172" text-anchor="middle">Seed bootstrap principals</text>
+  </g>
+
+  <g>
+    <text class="step" x="600" y="210">5</text>
+    <path class="arrow" d="M630 210 H460" />
+    <text class="label" x="540" y="202" text-anchor="middle">Return deterministic bootstrap state</text>
+  </g>
+
+  <g>
+    <text class="step" x="420" y="240">6</text>
+    <path class="arrow" d="M455 240 H280" />
+    <text class="label" x="360" y="232" text-anchor="middle">Registrar registers plugin + metadata</text>
+  </g>
+
+  <g>
+    <text class="step" x="250" y="270">7</text>
+    <path class="arrow" d="M280 270 H455" />
+    <text class="label" x="365" y="262" text-anchor="middle">Invoke WarmupAsync checks</text>
+  </g>
+
+  <g>
+    <text class="step" x="420" y="300">8</text>
+    <path class="arrow" d="M455 300 H780" />
+    <text class="label" x="620" y="292" text-anchor="middle">Emit authority.plugin.load audit event</text>
+  </g>
+
+  <g>
+    <text class="step" x="420" y="310">9</text>
+    <path class="arrow" d="M455 310 H930" />
+    <text class="label" x="700" y="302" text-anchor="middle">Forward structured logs and counters</text>
+  </g>
+
+  <g>
+    <text class="step" x="250" y="340">10</text>
+    <path class="arrow" d="M280 340 H110" />
+    <text class="label" x="200" y="332" text-anchor="middle">Report readiness to operator</text>
+  </g>
+</svg>