Add Initial Setup Supporting JSON for CycloneDX and SPDX - #2

Introduces a technical specification outlining canonical hashing rules for SBOM files. Covers input processing, format detection, normalization for JSON and XML, SHA-256 hashing, verification flow, and exclusion rules for deterministic hashing.

Introduces a comprehensive set of CycloneDX 1.7 test vectors in both JSON and XML formats, covering authenticity verification, vulnerability identification, integrity verification, remediation, pedigree, provenance, and vulnerability exploitability/disclosure scenarios.

Example SBOM files taken from here:

https://cyclonedx.org/use-cases/security/

Added 'package_sbom.json' and 'spdx-full-example.json' to test-vectors/spdx-3.0/json for validating SPDX 3.0 JSON document parsing and processing.

Taken from official SPDX repo here:

https://github.com/spdx/spdx-spec/tree/develop/examples

Introduces manifest.json listing CycloneDX 1.7 JSON test vectors with file paths, formats, names, SHA256 checksums, and source URLs for the example CycloneDX SBOMs.

Introduces a Go implementation for canonical SHA-256 hashing of validated SBOM JSON files, with CycloneDX signature exclusions and JCS canonicalization.

Includes go.mod/go.sum for dependencies and a test suite using shared test vectors.

Renamed CycloneDX 1.7 JSON test vector files to use the .cdx.json extension for clarity and consistency. Updated manifest.json to reference the new filenames.

Renamed 'package_sbom.json' and 'spdx-full-example.json' to include the '.spdx.json' suffix, improving file naming consistency and clarity in the test vectors.

Updated hash_test.go to test multiple JSON file variants (min, pretty, canonical) for each test case. Added min, pretty, and canonical variants of the CycloneDX 1.7 JSON test vectors. Updated manifest.json to include new file references.

Eliminated dependencies from hash.go. Switched JSON canonicalization from the jcs library to encoding/json/jsontext for RFC 8785 compliance. Updated go.mod and go.sum to remove unused dependencies.

Introduces a CI workflow to build and test the Go project. The workflow sets up the Go environment, builds the project, and runs tests in the ./go directory.

Changed the go-version-file path in the GitHub Actions workflow from 'go.mod' to 'go/go.mod' to correctly reference the Go module file location.

Renamed job and step names for clarity, updated actions/checkout to v6, added cache-dependency-path and disabled cache in setup-go, and enhanced step labels with emojis for better readability.

Added SPDX 3.0 JSON test vectors for full example and package SBOM in canonical, minified, and pretty formats. Updated manifest.json to include new SPDX 3.0 test vectors and renamed spdx-full-example.spdx.json to full-example.spdx.json.

Added canonical, minified, pretty, and standard SPDX 2.2 JSON example files under test-vectors/spdx-2.2/json. Updated manifest.json to include the new SPDX 2.2 JSON example and its variants for test coverage.

Reorders and restructures fields in CycloneDX 1.7 and SPDX test vector JSON files for consistency. No semantic changes to the test data; only field ordering and grouping were updated to match original files.

Includes python reference implementation and test harness

Add a name for the step showing the go version

Introduces a CI workflow to build and test the Python project. The workflow sets up the Python environment, install dependencies, and runs tests in the ./python directory.

Use latest version of markdown linter

Update the README and the GitHub workflow to use the requirements.txt file instead of repeating the package dependencies in multiple locations.

Added a simple test script to generate the different versions as well to ensure future consistency for test vectors used.

Only remove the signature value, not the full signature block

Applied to Go, Java, JavaScript, Python and Rust projects.

Includes the signature block minus the value property