Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Concelier/__Tests/StellaOps.Concelier.WebService.Tests/WebServiceEndpointsTests.cs

@@ -67,6 +67,7 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
     {
         _runner = MongoDbRunner.Start(singleNodeReplSet: true);
         _factory = new ConcelierApplicationFactory(_runner.ConnectionString);
+        WarmupFactory(_factory);
         return Task.CompletedTask;
     }
 
@@ -670,7 +671,10 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         using var client = _factory.CreateClient();
         client.DefaultRequestHeaders.Add("X-Stella-Tenant", "tenant-violation");
 
-        var invalidRequest = BuildAdvisoryIngestRequest(contentHash: string.Empty, upstreamId: "GHSA-INVALID-1");
+        var invalidRequest = BuildAdvisoryIngestRequest(
+            contentHash: string.Empty,
+            upstreamId: "GHSA-INVALID-1",
+            enforceContentHash: false);
         var response = await client.PostAsJsonAsync("/ingest/advisory", invalidRequest);
 
         Assert.Equal(HttpStatusCode.UnprocessableEntity, response.StatusCode);
@@ -1361,10 +1365,22 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         var snapshot = documents?.ToArray() ?? Array.Empty<AdvisoryObservationDocument>();
         if (snapshot.Length == 0)
         {
+            await collection.InsertManyAsync(snapshot);
             return;
         }
 
         await collection.InsertManyAsync(snapshot);
+
+        var rawDocuments = snapshot
+            .Select(doc => CreateAdvisoryRawDocument(
+                doc.Tenant,
+                doc.Source.Vendor,
+                doc.Id,
+                doc.Upstream.ContentHash,
+                doc.Content.Raw.DeepClone().AsBsonDocument))
+            .ToArray();
+
+        await SeedAdvisoryRawDocumentsAsync(rawDocuments);
     }
 
     private static AdvisoryObservationDocument[] BuildSampleObservationDocuments()
@@ -1501,6 +1517,11 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
             return value ?? string.Empty;
         }
 
+        if (!string.IsNullOrWhiteSpace(value))
+        {
+            return value.Trim();
+        }
+
         using var sha256 = SHA256.Create();
         var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(raw.GetRawText()));
         return $"sha256:{Convert.ToHexString(bytes).ToLowerInvariant()}";
@@ -1973,10 +1994,18 @@ public sealed class WebServiceEndpointsTests : IAsyncLifetime
         }
     }
 
-    private static AdvisoryIngestRequest BuildAdvisoryIngestRequest(string? contentHash, string upstreamId)
+    private static void WarmupFactory(WebApplicationFactory<Program> factory)
     {
-        var normalizedContentHash = contentHash ?? ComputeDeterministicContentHash(upstreamId);
-        var raw = CreateJsonElement($@"{{""id"":""{upstreamId}"",""modified"":""{DateTime.UtcNow:O}""}}");
+        using var client = factory.CreateClient();
+    }
+
+    private static AdvisoryIngestRequest BuildAdvisoryIngestRequest(
+        string? contentHash,
+        string upstreamId,
+        bool enforceContentHash = true)
+    {
+        var raw = CreateJsonElement($@"{{""id"":""{upstreamId}"",""modified"":""{DefaultIngestTimestamp:O}""}}");
+        var normalizedContentHash = NormalizeContentHash(contentHash, raw, enforceContentHash);
         var references = new[]
         {
             new AdvisoryLinksetReferenceRequest("advisory", $"https://example.test/advisories/{upstreamId}", null)