add bsi-v1 score functionality

[viveksahu26]

closes #413

This PR adds the following changes:

• Added docs for score command
• Implementation of score command for BSI-v1.1
• Renamed function with doc by sbom for better readability
• Implementation of score command for BSI-v2.0.0
• added component dependencies
  • For SPDX, relationship type of DEPENDS_ON will be counted as a dependency
  • FOR CDX: depends_on
• Updated README, with all list of features, it's description, and corresponding fields in CDX and SPDX for all categories.
• Added signature verification process for bsi-v2.0 score command:
  • For SPDX SBOM:

  sbomqs score -c bsi-v2.0 --sig samples/signature-test-data/sbom.sig --pub samples/signature-test-data/public_key.pem samples/signature-test-data/SPDXJSONExample-v2.3.spdx.json

  • For CycloneDX:

  $ sbomqs score -c bsi-v2.0  samples/signature-test-data/stree-cdxgen-signed-sbom.cdx.json 

• Include BSI-V1.1 and BSI-V2.0 features to list command also.

[riteshnoronha]

@viveksahu26 #331 (comment) comment about the parameter names.

[viveksahu26]

The o/p of bsi-v2.0 looks like:

1. For SPDX examples:

./sbomqs score --category bsi-v2.0.0  sbomqs/interlynk-io-sbomqs-v1.0.7-sbomqs-linux-amd64.spdx.sbom.json 
          
SBOM Quality by Interlynk Score:7.2	components:35	sbomqs/interlynk-io-sbomqs-v1.0.7-sbomqs-linux-amd64.spdx.sbom.json
+------------+------------------------------+-----------+--------------------------------+
|  CATEGORY  |           FEATURE            |   SCORE   |              DESC              |
+------------+------------------------------+-----------+--------------------------------+
| bsi-v2.0.0 | comp_with_associated_license | 10.0/10.0 | 35/35 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_concluded_license  | 10.0/10.0 | 35/35 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_declared_license   | 10.0/10.0 | 35/35 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_dependencies       | 9.7/10.0  | 34/35 have dependencies        |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_executable_hash    | 9.7/10.0  | 34/35 have checksums           |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_executable_uri     | 0.0/10.0  | 0/35 have executable URI       |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_name               | 10.0/10.0 | 35/35 have names               |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_source_code_hash   | 0.0/10.0  | 0/35 have source code hash     |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_source_code_uri    |  -        | no-deterministic-field in spdx |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_supplier           | 0.0/10.0  | 0/35 have supplier names       |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_uniq_ids           | 9.7/10.0  | 34/35 have unique ID's         |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_version            | 10.0/10.0 | 35/35 have versions            |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_authors                 | 10.0/10.0 | doc has 2 authors              |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_build_process           | 0.0/10.0  | doc has no build phase in      |
|            |                              |           | lifecycle                      |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_creation_timestamp      | 10.0/10.0 | doc has creation timestamp     |
|            |                              |           | 2025-06-06T05:52:18Z           |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_dependencies            | 10.0/10.0 | primary comp has 34            |
|            |                              |           | dependencies                   |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_signature          | 5.0/10.0  | Signature provided but         |
|            |                              |           | verification failed!           |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_uri                | 10.0/10.0 | doc has URI                    |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_vuln               | 10.0/10.0 | no vulnerabilities found       |
+            +------------------------------+-----------+--------------------------------+
|            | spec_with_version_compliant  | 10.0/10.0 | provided sbom spec: spdx, and  |
|            |                              |           | version: SPDX-2.3 is supported |
+------------+------------------------------+-----------+--------------------------------+

2. For CDX Example:

./sbomqs score --category bsi-v2.0  samples/sbomqs-cdx-cgomod.json

SBOM Quality by Interlynk Score:6.8	components:21	samples/sbomqs-cdx-cgomod.json
+------------+------------------------------+-----------+--------------------------------+
|  CATEGORY  |           FEATURE            |   SCORE   |              DESC              |
+------------+------------------------------+-----------+--------------------------------+
| bsi-v2.0.0 | comp_with_associated_license | 10.0/10.0 | 21/21 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_concluded_license  | 10.0/10.0 | 21/21 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_declared_license   | 10.0/10.0 | 21/21 have compliant licenses  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_dependencies       | 4.8/10.0  | 10/21 have dependencies        |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_executable_hash    | 0.0/10.0  | 0/21 have checksums            |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_executable_uri     | 0.0/10.0  | 0/21 have executable URI       |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_name               | 10.0/10.0 | 21/21 have names               |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_source_code_hash   |  -        | no-deterministic-field in cdx  |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_source_code_uri    | 7.1/10.0  | 15/21 have source code URI     |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_supplier           | 0.0/10.0  | 0/21 have supplier names       |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_uniq_ids           | 10.0/10.0 | 21/21 have unique ID's         |
+            +------------------------------+-----------+--------------------------------+
|            | comp_with_version            | 10.0/10.0 | 21/21 have versions            |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_authors                 | 10.0/10.0 | doc has 1 authors              |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_build_process           | 0.0/10.0  | doc has no build phase in      |
|            |                              |           | lifecycle                      |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_creation_timestamp      | 10.0/10.0 | doc has creation timestamp     |
|            |                              |           | 2023-05-04T02:34:37-07:00      |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_dependencies            | 10.0/10.0 | primary comp has 11            |
|            |                              |           | dependencies                   |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_signature          | 5.0/10.0  | Signature provided but         |
|            |                              |           | verification failed!           |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_uri                | 10.0/10.0 | doc has URI                    |
+            +------------------------------+-----------+--------------------------------+
|            | sbom_with_vuln               | 10.0/10.0 | no vulnerabilities found       |
+            +------------------------------+-----------+--------------------------------+
|            | spec_with_version_compliant  | 10.0/10.0 | provided sbom spec cyclonedx,  |
|            |                              |           | and version 1.4 is supported   |
+------------+------------------------------+-----------+--------------------------------+

The main thing to show here is comp_with_dependencies feature especially.

[fvsamson]

Thank you very much!
_{Though I have not had the time to review it in detail, this is looking fine to me.}