feat(lab4): SBOM, Grype/Trivy comparison, Lab 8 attestation

[Nopef]

Goal

Generate Juice Shop SBOMs with Syft, scan them with Grype, compare results with Trivy, and produce a sign-ready CycloneDX attestation for Lab 8.

Changes

• labs/lab4/juice-shop.cdx.json — CycloneDX 1.6 SBOM (1846 components)
• labs/lab4/juice-shop.spdx.json — SPDX SBOM (911 packages)
• labs/lab4/juice-shop-attestation.json — in-toto v1 envelope wrapping the CycloneDX BOM (Lab 8 Cosign input)
• submissions/lab4.md — Grype severity breakdown and top-10 CVEs, Grype vs Trivy comparison, attestation notes

Testing

• Syft cataloged 910 packages in bkimminich/juice-shop:v20.0.0
• Grype: 83 vulnerabilities — 6 Critical / 41 High / 27 Medium / 2 Low / 7 Negligible
• Trivy: 87 vulnerabilities — 5 Critical / 39 High / 31 Medium / 12 Low
• Attestation shape validated: _type, subject.digest, and predicateType (https://cyclonedx.org/bom/v1.5)

Artifacts

• Report: submissions/lab4.md

---

Checklist

• Task 1 — Syft SBOMs, Grype scan, top-10 CVE analysis
• Task 2 — Trivy comparison and tool tradeoffs
• Bonus — sign-ready CycloneDX attestation for Lab 8