feat: add security sink detection patterns for JavaScript/TypeScript

- Introduced `sink-detect.js` with various security sink detection patterns categorized by type (e.g., command injection, SQL injection, file operations).
- Implemented functions to build a lookup map for fast sink detection and to match sink calls against known patterns.
- Added `package-lock.json` for dependency management.

tests/interop/StellaOps.Interop.Tests/Models.cs

@@ -0,0 +1,78 @@
+// -----------------------------------------------------------------------------
+// Models.cs
+// Sprint: SPRINT_5100_0003_0001_sbom_interop_roundtrip
+// Task: T1, T7 - Interop Test Harness & Project Setup
+// Description: Models for SBOM interoperability testing.
+// -----------------------------------------------------------------------------
+
+using System.Collections.Immutable;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace StellaOps.Interop.Tests;
+
+public enum SbomFormat
+{
+    CycloneDx16,
+    Spdx30
+}
+
+public sealed record SbomResult(
+    bool Success,
+    string? Path = null,
+    SbomFormat? Format = null,
+    string? Content = null,
+    string? Digest = null,
+    string? Error = null)
+{
+    public static SbomResult Failed(string error) => new(false, Error: error);
+}
+
+public sealed record AttestationResult(
+    bool Success,
+    string? ImageRef = null,
+    string? Error = null)
+{
+    public static AttestationResult Failed(string error) => new(false, Error: error);
+}
+
+public sealed record GrypeScanResult(
+    bool Success,
+    IReadOnlyList<GrypeFinding>? Findings = null,
+    string? RawOutput = null,
+    string? Error = null)
+{
+    public static GrypeScanResult Failed(string error) => new(false, Error: error);
+}
+
+public sealed record GrypeFinding(
+    string VulnerabilityId,
+    string PackagePurl,
+    string Severity,
+    string? FixedIn = null);
+
+public sealed record Finding(
+    string VulnerabilityId,
+    string PackagePurl,
+    string Severity);
+
+public sealed record ToolResult(
+    bool Success,
+    string Output,
+    string? Error = null);
+
+public sealed record FindingsComparisonResult(
+    decimal ParityPercent,
+    bool IsWithinTolerance,
+    int StellaTotalFindings,
+    int GrypeTotalFindings,
+    int MatchingFindings,
+    int OnlyInStella,
+    int OnlyInGrype,
+    IReadOnlyList<(string VulnId, string Purl)> OnlyInStellaDetails,
+    IReadOnlyList<(string VulnId, string Purl)> OnlyInGrypeDetails);
+
+public sealed record VerifyResult(
+    bool Success,
+    string? PredicateDigest = null,
+    string? Error = null);