fix(sbom): preserve opaque bom-ref identity - #114

Summary

• Preserve case for �om_ref fallback identities; trim surrounding whitespace only.
• Keep purl authority explicit and prevent bom-ref-only records from aliasing purl keys.
• Add a CycloneDX case-differing fixture plus exact-duplicate and conflicting-metadata tests.
• Document the opaque local identifier boundary in the v1.1 identity contract.

Design decision

�om_ref is an opaque local identifier when no purl is present. Lowercasing it would merge distinct producer-local identifiers such as Component-A and component-a. Identity precedence remains purl -> �om_ref -> normalized coordinate.

Main risk

Existing inputs that relied on case-insensitive bom-ref matching can now produce separate components instead of an accidental merge. This is the intended fail-closed behavior for ambiguous local identifiers.

Compatibility impact

Purl-backed identities and coordinate fallback behavior are unchanged. The package remains at the already-established 1.1.0.dev0 development version; this PR does not create a release tag or publish artifacts.

Rollback path

Revert commit d3a9e9f if downstream evidence shows that case-insensitive bom-ref matching is an intentional producer contract.

Validation

• python -m pytest -> 224 passed
• python -m pytest tests/test_component_identity.py tests/test_diffing.py -> 26 passed
• python -m build --outdir build\validation -> sdist and wheel built for 1.1.0.dev0
• python scripts\validate-reviewer-routes.py -> passed
• gitleaks detect --no-git --redact -> no leaks found
• git diff --check -> passed