fix: include vulnerabilities in CycloneDX SBOM

[SwaatiR]

Summary

Fixes #197.

CycloneDX SBOM generation was producing the component inventory but not including vulnerability findings.

generate_sbom() now explicitly enables Trivy's vulnerability scanner using --scanners vuln, so vulnerability findings are included in the generated CycloneDX SBOM.

Verification

Reproduced using:

ubuntu:stonking-20260705

Before the fix:

• Normal JSON report: 14 vulnerabilities
• CycloneDX SBOM: 0 vulnerabilities
• CycloneDX components: 103

After the fix:

• Normal JSON report: 14 vulnerabilities
• CycloneDX SBOM: 20 vulnerabilities
• CycloneDX components: 103

The SBOM vulnerability count is higher because the normal DockSec report is severity-filtered, while the SBOM vulnerability scan is not.

Tests

Added regression coverage for:

• CycloneDX SBOM vulnerability scanning
• Offline SBOM generation

Full test suite:

546 passed, 3 skipped, 153 subtests passed