Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

docs/security/dpop-mtls-rollout.md

@@ -0,0 +1,45 @@
+# Authority DPoP + mTLS Rollout Plan (Sprint 100)
+
+_Last updated: 2025-11-07_
+
+## Objectives
+1. Enforce DPoP sender constraints (`AUTH-DPOP-11-001`).
+2. Bind high-assurance tenants to mTLS tokens (`AUTH-MTLS-11-002`).
+3. Provide telemetry + runbooks so plugins (SEC2/SEC3/SEC5) can validate enforcement without regressions.
+
+## Phase 1 · Config & Telemetry (ETA 2025-11-08)
+- [ ] Extend `authority.yaml` with `security.senderConstraints.dpop` section (nonce store, allowed algorithms, replay window).
+- [ ] Wire structured logs (`authority.dpop.request`) containing tenant, client, cnf thumbprint, nonce status.
+- [ ] Add `DPoPNonceStore` abstraction + Redis implementation for multi-node deployments.
+- [ ] Update integration tests: `AuthorityTokenTests.DPoPNonceRequired`, `AuthorityTokenTests.DPoPMustMatchCnF`.
+
+## Phase 2 · Enforcement & Fallback (ETA 2025-11-10)
+- [ ] Reject `/token` requests lacking DPoP proof when tenant policy requires it.
+- [ ] Persist `cnf.jkt` and expose through `/introspect` so downstream services validate sender.
+- [ ] Add emergency bypass flag (`security.senderConstraints.dpop.allowTemporaryBypass`) for sealed recap drills; default disabled.
+
+## Phase 3 · mTLS Binding (ETA 2025-11-10)
+- [x] Capture client cert thumbprint on `/token` (mutual TLS) and store in `authority_tokens.senderCertificate`.
+- [x] Validate cert hash on `/introspect` and `/fresh-auth`.
+- [ ] Document bootstrap/rotation in `docs/11_AUTHORITY.md` + `docs/security/dpop-mtls-rollout.md` (this file).
+
+## Verification Matrix
+| Scenario | Test/Command | Expected |
+| --- | --- | --- |
+| DPoP required w/out proof | `dotnet test Authority.Tests --filter DPoPRequiresProofTest` | 400 with `use_dpop_nonce` header. |
+| Nonce replay | Replay previous proof within window | 401 + audit log entry. |
+| mTLS mismatch | Reuse token with different cert | 401 + `senderCertificateMismatch` metric increment. |
+
+## Telemetry & Alerting
+- Metrics: `authority_dpop_nonce_miss_total`, `authority_mtls_mismatch_total` (emitted with `reason` tags for context-missing, missing-certificate, and thumbprint-mismatch cases).
+- Logs: `authority.security.senderConstraint` (structured).
+- Alerts: Page DevOps when nonce miss > 5% or mTLS mismatches > 0 over 10 min.
+
+## Dependencies
+- Authority Core & Security Guild owners.
+- DevOps to provide sealed-mode CI coverage (`DEVOPS-AIRGAP-57-002`).
+- Plugin Standard Guild to consume new telemetry once rolled out.
+
+## Communication
+- Daily async update in `#guild-authority` thread referencing this plan.
+- Link this document from `docs/implplan/SPRINT_100_identity_signing.md` notes once Phase 1 merges.