Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Scanner/StellaOps.Scanner.Sbomer.BuildXPlugin/Descriptor/DescriptorGenerator.cs

@@ -2,10 +2,10 @@ using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IO;
-using System.Security.Cryptography;
-using System.Text;
-using System.Threading;
-using System.Threading.Tasks;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Scanner.Sbomer.BuildXPlugin.Descriptor;
 
@@ -16,13 +16,14 @@ public sealed class DescriptorGenerator
 {
     public const string Schema = "stellaops.buildx.descriptor.v1";
 
-    private readonly TimeProvider timeProvider;
-
-    public DescriptorGenerator(TimeProvider timeProvider)
-    {
-        timeProvider ??= TimeProvider.System;
-        this.timeProvider = timeProvider;
-    }
+    private readonly TimeProvider _timeProvider;
+    private readonly ICryptoHash _hash;
+
+    public DescriptorGenerator(TimeProvider timeProvider, ICryptoHash hash)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
+    }
 
     public async Task<DescriptorDocument> CreateAsync(DescriptorRequest request, CancellationToken cancellationToken)
     {
@@ -78,7 +79,7 @@ public sealed class DescriptorGenerator
 
         return new DescriptorDocument(
             Schema: Schema,
-            GeneratedAt: timeProvider.GetUtcNow(),
+            GeneratedAt: _timeProvider.GetUtcNow(),
             Generator: generatorMetadata,
             Subject: subject,
             Artifact: artifact,
@@ -86,7 +87,7 @@ public sealed class DescriptorGenerator
             Metadata: metadata);
     }
 
-    private static string ComputeDeterministicNonce(DescriptorRequest request, FileInfo sbomFile, string sbomDigest)
+    private string ComputeDeterministicNonce(DescriptorRequest request, FileInfo sbomFile, string sbomDigest)
     {
         var builder = new StringBuilder();
         builder.AppendLine("stellaops.buildx.nonce.v1");
@@ -108,45 +109,33 @@ public sealed class DescriptorGenerator
         builder.AppendLine(request.PredicateType);
 
         var payload = Encoding.UTF8.GetBytes(builder.ToString());
-        Span<byte> hash = stackalloc byte[32];
-        SHA256.HashData(payload, hash);
-
+        var digest = _hash.ComputeHash(payload, HashAlgorithms.Sha256);
         Span<byte> nonceBytes = stackalloc byte[16];
-        hash[..16].CopyTo(nonceBytes);
+        digest.AsSpan(0, 16).CopyTo(nonceBytes);
         return Convert.ToHexString(nonceBytes).ToLowerInvariant();
     }
 
-    private static async Task<string> ComputeFileDigestAsync(FileInfo file, CancellationToken cancellationToken)
-    {
-        await using var stream = new FileStream(
-            file.FullName,
-            FileMode.Open,
-            FileAccess.Read,
-            FileShare.Read,
-            bufferSize: 128 * 1024,
-            FileOptions.Asynchronous | FileOptions.SequentialScan);
-
-        using var hash = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
-
-        var buffer = new byte[128 * 1024];
-        int bytesRead;
-        while ((bytesRead = await stream.ReadAsync(buffer.AsMemory(0, buffer.Length), cancellationToken).ConfigureAwait(false)) > 0)
-        {
-            hash.AppendData(buffer, 0, bytesRead);
-        }
-
-        var digest = hash.GetHashAndReset();
-        return $"sha256:{Convert.ToHexString(digest).ToLowerInvariant()}";
-    }
-
-    private static string ComputeExpectedDsseDigest(string imageDigest, string sbomDigest, string nonce)
-    {
-        var payload = $"{imageDigest}\n{sbomDigest}\n{nonce}";
-        var bytes = System.Text.Encoding.UTF8.GetBytes(payload);
-        Span<byte> hash = stackalloc byte[32];
-        SHA256.HashData(bytes, hash);
-        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
-    }
+    private async Task<string> ComputeFileDigestAsync(FileInfo file, CancellationToken cancellationToken)
+    {
+        await using var stream = new FileStream(
+            file.FullName,
+            FileMode.Open,
+            FileAccess.Read,
+            FileShare.Read,
+            bufferSize: 128 * 1024,
+            FileOptions.Asynchronous | FileOptions.SequentialScan);
+
+        var digest = await _hash.ComputeHashAsync(stream, HashAlgorithms.Sha256, cancellationToken).ConfigureAwait(false);
+        return $"sha256:{Convert.ToHexString(digest).ToLowerInvariant()}";
+    }
+
+    private string ComputeExpectedDsseDigest(string imageDigest, string sbomDigest, string nonce)
+    {
+        var payload = $"{imageDigest}\n{sbomDigest}\n{nonce}";
+        var bytes = Encoding.UTF8.GetBytes(payload);
+        var digest = _hash.ComputeHash(bytes, HashAlgorithms.Sha256);
+        return $"sha256:{Convert.ToHexString(digest).ToLowerInvariant()}";
+    }
 
     private static IReadOnlyDictionary<string, string> BuildArtifactAnnotations(DescriptorRequest request, string nonce, string expectedDsse)
     {