sbom-scorecard

fix: Update Go version to 1.25 in workflow files

fix: Replace errors.New with fmt.Errorf in validateFlags

fix: Enhance tool metadata handling in GetCycloneDXReport to support components and services

fix: Verify metadata is non-nil before accessing for timestamp

fix hasPurlOrCPE check to actually be an OR check instead of AND in GetSpdxReport