Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

src/__Libraries/StellaOps.Cryptography.Kms/Pkcs11Options.cs

@@ -0,0 +1,72 @@
+namespace StellaOps.Cryptography.Kms;
+
+/// <summary>
+/// Configuration for PKCS#11-based HSM integrations.
+/// </summary>
+public sealed class Pkcs11Options
+{
+    private TimeSpan metadataCacheDuration = TimeSpan.FromMinutes(5);
+    private TimeSpan publicKeyCacheDuration = TimeSpan.FromMinutes(5);
+
+    /// <summary>
+    /// Gets or sets the native PKCS#11 library path.
+    /// </summary>
+    public string LibraryPath { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets an optional slot identifier (decimal or hexadecimal). Mutually exclusive with <see cref="TokenLabel"/>.
+    /// </summary>
+    public string? SlotId { get; set; }
+
+    /// <summary>
+    /// Gets or sets an optional token label to select the target slot. Mutually exclusive with <see cref="SlotId"/>.
+    /// </summary>
+    public string? TokenLabel { get; set; }
+
+    /// <summary>
+    /// Gets or sets the PKCS#11 private key label.
+    /// </summary>
+    public string? PrivateKeyLabel { get; set; }
+
+    /// <summary>
+    /// Gets or sets the PKCS#11 public key label (optional; falls back to <see cref="PrivateKeyLabel"/>).
+    /// </summary>
+    public string? PublicKeyLabel { get; set; }
+
+    /// <summary>
+    /// Gets or sets the PIN used for user authentication.
+    /// </summary>
+    public string? UserPin { get; set; }
+
+    /// <summary>
+    /// Gets or sets an optional PKCS#11 mechanism identifier (default: CKM_ECDSA).
+    /// </summary>
+    public uint MechanismId { get; set; } = (uint)Net.Pkcs11Interop.Common.CKM.CKM_ECDSA;
+
+    /// <summary>
+    /// Gets or sets the cache duration for metadata requests (slot/key info).
+    /// </summary>
+    public TimeSpan MetadataCacheDuration
+    {
+        get => metadataCacheDuration;
+        set => metadataCacheDuration = EnsurePositive(value, TimeSpan.FromMinutes(5));
+    }
+
+    /// <summary>
+    /// Gets or sets the cache duration for public key material.
+    /// </summary>
+    public TimeSpan PublicKeyCacheDuration
+    {
+        get => publicKeyCacheDuration;
+        set => publicKeyCacheDuration = EnsurePositive(value, TimeSpan.FromMinutes(5));
+    }
+
+    /// <summary>
+    /// Gets or sets an optional factory for advanced facade injection (testing, custom providers).
+    /// </summary>
+    public Func<IServiceProvider, IPkcs11Facade>? FacadeFactory { get; set; }
+
+    private static TimeSpan EnsurePositive(TimeSpan value, TimeSpan fallback)
+        => value <= TimeSpan.Zero ? fallback : value;
+}
+