feat: Initialize Zastava Webhook service with TLS and Authority authentication

- Added Program.cs to set up the web application with Serilog for logging, health check endpoints, and a placeholder admission endpoint.
- Configured Kestrel server to use TLS 1.3 and handle client certificates appropriately.
- Created StellaOps.Zastava.Webhook.csproj with necessary dependencies including Serilog and Polly.
- Documented tasks in TASKS.md for the Zastava Webhook project, outlining current work and exit criteria for each task.

samples/scanner/images/distroless-go/bom-index.json

@@ -0,0 +1,32 @@
+{
+  "schema": "stellaops/bom-index@1",
+  "image": {
+    "repository": "gcr.io/distroless/base",
+    "digest": "sha256:0dd2f0f15c9f8abfba6a0ce0d7d6a24e2e1071c977733f6e77cbe51b87f15ad9",
+    "tag": "nonroot"
+  },
+  "generatedAt": "2025-10-19T00:00:00Z",
+  "generator": "stellaops/scanner@10.0.0-preview1",
+  "components": [
+    {
+      "purl": "pkg:golang/github.com/stellaops/sample-service@v1.4.0",
+      "layerDigest": "sha256:8888888888888888888888888888888888888888888888888888888888888888",
+      "usage": ["inventory", "runtime"],
+      "licenses": ["Apache-2.0"],
+      "evidence": {
+        "kind": "go-buildinfo",
+        "path": "/workspace/service"
+      }
+    },
+    {
+      "purl": "pkg:golang/std@go1.22.5",
+      "layerDigest": "sha256:9999999999999999999999999999999999999999999999999999999999999999",
+      "usage": ["inventory"],
+      "licenses": ["BSD-3-Clause"],
+      "evidence": {
+        "kind": "go-buildinfo",
+        "path": "/workspace/service"
+      }
+    }
+  ]
+}