Turn Trivy SBOM and SARIF output into versioned release evidence

Security tools already generate useful evidence. The problem at release time is often not another...