Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Scanner/StellaOps.Scanner.WebService/Services/SurfacePointerService.cs

@@ -7,6 +7,7 @@ using System.Text.Json;
 using System.Text.Json.Serialization;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using StellaOps.Cryptography;
 using StellaOps.Scanner.Storage;
 using StellaOps.Scanner.Storage.Catalog;
 using StellaOps.Scanner.Storage.ObjectStore;
@@ -36,6 +37,7 @@ internal sealed class SurfacePointerService : ISurfacePointerService
     private readonly ISurfaceEnvironment _surfaceEnvironment;
     private readonly TimeProvider _timeProvider;
     private readonly ILogger<SurfacePointerService> _logger;
+    private readonly ICryptoHash _hash;
 
     public SurfacePointerService(
         LinkRepository linkRepository,
@@ -43,7 +45,8 @@ internal sealed class SurfacePointerService : ISurfacePointerService
         IOptionsMonitor<ScannerWebServiceOptions> optionsMonitor,
         ISurfaceEnvironment surfaceEnvironment,
         TimeProvider timeProvider,
-        ILogger<SurfacePointerService> logger)
+        ILogger<SurfacePointerService> logger,
+        ICryptoHash hash)
     {
         _linkRepository = linkRepository ?? throw new ArgumentNullException(nameof(linkRepository));
         _artifactRepository = artifactRepository ?? throw new ArgumentNullException(nameof(artifactRepository));
@@ -51,6 +54,7 @@ internal sealed class SurfacePointerService : ISurfacePointerService
         _surfaceEnvironment = surfaceEnvironment ?? throw new ArgumentNullException(nameof(surfaceEnvironment));
         _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
     }
 
     public async Task<SurfacePointersDto?> TryBuildAsync(string imageDigest, CancellationToken cancellationToken)
@@ -275,15 +279,9 @@ internal sealed class SurfacePointerService : ISurfacePointerService
             ? string.Empty
             : value.Trim().TrimEnd('/');
 
-    private static string ComputeDigest(ReadOnlySpan<byte> payload)
+    private string ComputeDigest(ReadOnlySpan<byte> payload)
     {
-        Span<byte> hash = stackalloc byte[32];
-        if (!SHA256.TryHashData(payload, hash, out _))
-        {
-            using var sha = SHA256.Create();
-            hash = sha.ComputeHash(payload.ToArray());
-        }
-
-        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+        var hex = _hash.ComputeHashHex(payload, HashAlgorithms.Sha256);
+        return $"sha256:{hex}";
     }
 }