feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

samples/scanner/README.md

@@ -0,0 +1,12 @@
+# Scanner Samples
+
+Curated SBOM and BOM Index fixtures covering representative container types referenced throughout Sprint 10. Each sample folder under `images/` corresponds to a container profile, while `../runtime` holds trimmed filesystem fixtures used by analyzer and perf tests.
+
+| Sample | Highlights |
+| ------ | ---------- |
+| `nginx` | Alpine packages with mixed inventory/runtime coverage. |
+| `alpine-busybox` | Minimal BusyBox rootfs with musl runtime linkage. |
+| `distroless-go` | Go binary with Distroless base and Go build-info evidence. |
+| `dotnet-aot` | Ahead-of-time compiled .NET worker exposing NuGet dependencies. |
+| `python-venv` | Python virtualenv with `*.dist-info` evidence. |
+| `npm-monorepo` | Node workspace packages resolved via `package.json`. |