Improve SBOM artifact stage and scope analysis

[NiXouuuu]

Closes #1608.

Summary

• Add an explicit artifact-stage gate before SBOM vulnerability priority and license classification.
• Add component-scope bucketing for runtime, optional runtime, dev/test, build-only, excluded, and unknown-scope components.
• Update transitive dependency, license analysis, findings classification, output format, common pitfalls, and prompt-injection guardrails to keep runtime risk separate from source/build/test inventory.

Validation

• git diff --check
• Markdown fence-balance check for skills/vuln-management/sbom-analysis/SKILL.md
• Required marker check for artifact-stage, component-scope, runtime dependency, unknown-scope, and v1.1.0 output additions

Payment preference: PayPal; details can be provided privately after maintainer acceptance.