Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

src/Findings/StellaOps.Findings.Ledger/migrations/003_policy_rationale.sql

@@ -0,0 +1,16 @@
+-- 003_policy_rationale.sql
+-- Add policy rationale column to findings_projection (LEDGER-29-004)
+
+BEGIN;
+
+ALTER TABLE findings_projection
+    ADD COLUMN IF NOT EXISTS policy_rationale JSONB NOT NULL DEFAULT '[]'::JSONB;
+
+ALTER TABLE findings_projection
+    ALTER COLUMN policy_rationale SET DEFAULT '[]'::JSONB;
+
+UPDATE findings_projection
+   SET policy_rationale = '[]'::JSONB
+ WHERE policy_rationale IS NULL;
+
+COMMIT;