Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Findings/StellaOps.Findings.Ledger.WebService/Program.cs

@@ -19,6 +19,7 @@ using StellaOps.Findings.Ledger.Services;
 using StellaOps.Findings.Ledger.WebService.Contracts;
 using StellaOps.Findings.Ledger.WebService.Mappings;
 using StellaOps.Telemetry.Core;
+using StellaOps.Findings.Ledger.Services.Security;
 
 const string LedgerWritePolicy = "ledger.events.write";
 
@@ -126,6 +127,10 @@ builder.Services.AddSingleton<PolicyEvaluationCache>();
 builder.Services.AddSingleton<PolicyEngineEvaluationService>();
 builder.Services.AddSingleton<IPolicyEvaluationService>(sp => sp.GetRequiredService<PolicyEngineEvaluationService>());
 builder.Services.AddSingleton<ILedgerEventWriteService, LedgerEventWriteService>();
+builder.Services.AddSingleton<IFindingWorkflowService, FindingWorkflowService>();
+builder.Services.AddSingleton<IAttachmentEncryptionService, AttachmentEncryptionService>();
+builder.Services.AddSingleton<IAttachmentUrlSigner, AttachmentUrlSigner>();
+builder.Services.AddSingleton<IConsoleCsrfValidator, ConsoleCsrfValidator>();
 builder.Services.AddHostedService<LedgerMerkleAnchorWorker>();
 builder.Services.AddHostedService<LedgerProjectionWorker>();
 
@@ -156,10 +161,14 @@ app.UseAuthorization();
 app.MapHealthChecks("/healthz");
 
 app.MapPost("/vuln/ledger/events", async Task<Results<Created<LedgerEventResponse>, Ok<LedgerEventResponse>, ProblemHttpResult>> (
+    HttpContext httpContext,
+    IConsoleCsrfValidator csrfValidator,
     LedgerEventRequest request,
     ILedgerEventWriteService writeService,
     CancellationToken cancellationToken) =>
 {
+    csrfValidator.Validate(httpContext);
+
     var draft = request.ToDraft();
     var result = await writeService.AppendAsync(draft, cancellationToken).ConfigureAwait(false);
     return result.Status switch