Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Scanner/__Tests/StellaOps.Scanner.Sbomer.BuildXPlugin.Tests/Surface/SurfaceManifestWriterTests.cs

@@ -3,6 +3,7 @@ using System.IO;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using StellaOps.Cryptography;
 using StellaOps.Scanner.Sbomer.BuildXPlugin.Surface;
 using StellaOps.Scanner.Sbomer.BuildXPlugin.Tests.TestUtilities;
 using Xunit;
@@ -42,7 +43,7 @@ public sealed class SurfaceManifestWriterTests
             EntryTraceNdjsonPath: ndjsonPath,
             ManifestOutputPath: manifestOutputPath);
 
-        var writer = new SurfaceManifestWriter(TimeProvider.System);
+        var writer = new SurfaceManifestWriter(TimeProvider.System, CryptoHashFactory.CreateDefault());
         var result = await writer.WriteAsync(options, CancellationToken.None);
 
         Assert.NotNull(result);
@@ -88,7 +89,7 @@ public sealed class SurfaceManifestWriterTests
             EntryTraceNdjsonPath: null,
             ManifestOutputPath: null);
 
-        var writer = new SurfaceManifestWriter(TimeProvider.System);
+        var writer = new SurfaceManifestWriter(TimeProvider.System, CryptoHashFactory.CreateDefault());
         var result = await writer.WriteAsync(options, CancellationToken.None);
         Assert.Null(result);
     }