feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

samples/scanner/images/python-venv/README.md

@@ -0,0 +1,3 @@
+# Python Virtualenv Sample
+
+Pairs with the runtime fixture under `samples/runtime/python-venv`. The SBOMs highlight how requests pulls in urllib3 and certifi, and the BOM Index records the `*.dist-info/METADATA` evidence paths used by the Python analyzer.

samples/scanner/images/python-venv/bom-index.json

@@ -0,0 +1,42 @@
+{
+  "schema": "stellaops/bom-index@1",
+  "image": {
+    "repository": "docker.io/library/python",
+    "digest": "sha256:dbed08b7d9675c2be627bbecac182a04c36d3f4ffd542c4fba7c7a850a6578dc",
+    "tag": "3.12-slim"
+  },
+  "generatedAt": "2025-10-19T00:00:00Z",
+  "generator": "stellaops/scanner@10.0.0-preview1",
+  "components": [
+    {
+      "purl": "pkg:pypi/requests@2.32.0",
+      "layerDigest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "usage": ["inventory", "runtime"],
+      "licenses": ["Apache-2.0"],
+      "evidence": {
+        "kind": "dist-info",
+        "path": "lib/python3.11/site-packages/requests-2.32.0.dist-info/METADATA"
+      }
+    },
+    {
+      "purl": "pkg:pypi/urllib3@2.2.1",
+      "layerDigest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "usage": ["inventory", "runtime"],
+      "licenses": ["MIT"],
+      "evidence": {
+        "kind": "dist-info",
+        "path": "lib/python3.11/site-packages/urllib3-2.2.1.dist-info/METADATA"
+      }
+    },
+    {
+      "purl": "pkg:pypi/certifi@2024.6.2",
+      "layerDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "usage": ["inventory"],
+      "licenses": ["MPL-2.0"],
+      "evidence": {
+        "kind": "dist-info",
+        "path": "lib/python3.11/site-packages/certifi-2024.6.2.dist-info/METADATA"
+      }
+    }
+  ]
+}

samples/scanner/images/python-venv/inventory.cdx.json

@@ -0,0 +1,34 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2025-10-19T00:00:00Z",
+    "component": {
+      "type": "container",
+      "name": "python-venv",
+      "version": "3.12-slim",
+      "bomRef": "pkg:docker/library/python@sha256:dbed08b7d9675c2be627bbecac182a04c36d3f4ffd542c4fba7c7a850a6578dc"
+    }
+  },
+  "components": [
+    {
+      "type": "application",
+      "bomRef": "pkg:pypi/requests@2.32.0",
+      "name": "requests",
+      "version": "2.32.0"
+    },
+    {
+      "type": "library",
+      "bomRef": "pkg:pypi/urllib3@2.2.1",
+      "name": "urllib3",
+      "version": "2.2.1"
+    },
+    {
+      "type": "library",
+      "bomRef": "pkg:pypi/certifi@2024.6.2",
+      "name": "certifi",
+      "version": "2024.6.2"
+    }
+  ]
+}

samples/scanner/images/python-venv/usage.cdx.json

@@ -0,0 +1,28 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2025-10-19T00:00:00Z",
+    "component": {
+      "type": "container",
+      "name": "python-venv",
+      "version": "3.12-slim",
+      "bomRef": "pkg:docker/library/python@sha256:dbed08b7d9675c2be627bbecac182a04c36d3f4ffd542c4fba7c7a850a6578dc"
+    }
+  },
+  "components": [
+    {
+      "type": "application",
+      "bomRef": "pkg:pypi/requests@2.32.0",
+      "name": "requests",
+      "version": "2.32.0"
+    },
+    {
+      "type": "library",
+      "bomRef": "pkg:pypi/urllib3@2.2.1",
+      "name": "urllib3",
+      "version": "2.2.1"
+    }
+  ]
+}