Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

etc/signals.yaml.sample

@@ -23,6 +23,7 @@ Signals:
   Mongo:
     ConnectionString: "mongodb://localhost:27017/signals"
     Database: "signals"
-    CallgraphsCollection: "callgraphs"
+    CallgraphsCollection: "callgraphs"
+    ReachabilityFactsCollection: "reachability_facts"
   Storage:
     RootPath: "../data/signals-artifacts"