Open-source component vulnerability scanning: SCA, SBOM, and fix priority

SCA practice guide: from SBOM and CVE/CVSS to fix priority, covering dependency, artifact, and image scan differences. Build triage rules and gate thresholds so low-priority vulns do not crush the fix cadence.