feat: Enhance SBOM composition with policy findings and update CycloneDX package

- Added `PolicyFindings` property to `SbomCompositionRequest` to include policy findings in SBOM.
- Implemented `NormalizePolicyFindings` method to process and validate policy findings.
- Updated `SbomCompositionRequest.Create` method to accept policy findings as an argument.
- Upgraded CycloneDX.Core package from version 5.1.0 to 10.0.1.
- Marked several tasks as DONE in TASKS.md, reflecting completion of SBOM-related features.
- Introduced telemetry metrics for Go analyzer to track heuristic fallbacks.
- Added performance benchmarks for .NET and Go analyzers.
- Created new test fixtures for .NET applications, including dependencies and runtime configurations.
- Added licenses and nuspec files for logging and toolkit packages used in tests.
- Implemented `SbomPolicyFinding` record to encapsulate policy finding details and normalization logic.

bench/Scanner.Analyzers/StellaOps.Bench.ScannerAnalyzers/ScenarioRunners.cs

@@ -4,8 +4,10 @@ using System.Linq;
 using System.Text.Json;
 using System.Text.RegularExpressions;
 using StellaOps.Scanner.Analyzers.Lang;
+using StellaOps.Scanner.Analyzers.Lang.Go;
 using StellaOps.Scanner.Analyzers.Lang.Java;
 using StellaOps.Scanner.Analyzers.Lang.Node;
+using StellaOps.Scanner.Analyzers.Lang.DotNet;
 
 namespace StellaOps.Bench.ScannerAnalyzers.Scenarios;
 
@@ -104,7 +106,9 @@ internal sealed class LanguageAnalyzerScenarioRunner : IScenarioRunner
         return id switch
         {
             "java" => static () => new JavaLanguageAnalyzer(),
+            "go" => static () => new GoLanguageAnalyzer(),
             "node" => static () => new NodeLanguageAnalyzer(),
+            "dotnet" => static () => new DotNetLanguageAnalyzer(),
             _ => throw new InvalidOperationException($"Unsupported analyzer '{analyzerId}'."),
         };
     }