Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

etc/secrets/notify-web-airgap.secret.example

@@ -0,0 +1,9 @@
+# Replace this file with the site-specific client secret for the notify-web
+# Authority client when running in sealed / air-gapped environments.
+#
+# Keep the secret outside version control. When building the Bootstrap Pack or
+# Offline Kit, copy the populated file alongside notify.yaml so the container
+# can load it via environment injection (for example `env_file` or Kubernetes
+# Secret mounts).
+
+NOTIFY_WEB_CLIENT_SECRET=change-me-airgap