feat: Enhance SBOM composition with policy findings and update CycloneDX package

- Added `PolicyFindings` property to `SbomCompositionRequest` to include policy findings in SBOM.
- Implemented `NormalizePolicyFindings` method to process and validate policy findings.
- Updated `SbomCompositionRequest.Create` method to accept policy findings as an argument.
- Upgraded CycloneDX.Core package from version 5.1.0 to 10.0.1.
- Marked several tasks as DONE in TASKS.md, reflecting completion of SBOM-related features.
- Introduced telemetry metrics for Go analyzer to track heuristic fallbacks.
- Added performance benchmarks for .NET and Go analyzers.
- Created new test fixtures for .NET applications, including dependencies and runtime configurations.
- Added licenses and nuspec files for logging and toolkit packages used in tests.
- Implemented `SbomPolicyFinding` record to encapsulate policy finding details and normalization logic.

bench/Scanner.Analyzers/config.json

@@ -18,11 +18,27 @@
         "java"
       ]
     },
+    {
+      "id": "go_buildinfo_fixture",
+      "label": "Go analyzer on build-info binary",
+      "root": "src/StellaOps.Scanner.Analyzers.Lang.Go.Tests/Fixtures/lang/go/basic",
+      "analyzers": [
+        "go"
+      ]
+    },
+    {
+      "id": "dotnet_multirid_fixture",
+      "label": ".NET analyzer on multi-RID fixture",
+      "root": "src/StellaOps.Scanner.Analyzers.Lang.Tests/Fixtures/lang/dotnet/multi",
+      "analyzers": [
+        "dotnet"
+      ]
+    },
     {
       "id": "python_site_packages_walk",
       "label": "Python site-packages dist-info crawl",
       "root": "samples/runtime/python-venv/lib/python3.11/site-packages",
-      "matcher": "**/*.dist-info/METADATA",
+      "matcher": "**/*.dist-info/METADATA",
       "parser": "python"
     }
   ]