fix: SBOM multi-ecosystem support with correct package managers and licenses

- Extract package manager from PURL instead of CycloneDX component type
  (was showing "library"/"file" instead of "npm"/"cargo"/"pip" etc.)
- Generate missing lock files (Cargo.lock, package-lock.json) before Syft
  scan so repos that gitignore them still get full dependency trees
- Enable Syft remote license lookups for Go, JS, Python, and Java
- Enrich Cargo entries with license data from cargo metadata
- Parse CycloneDX license expressions (e.g. "MIT OR Apache-2.0")
- Delete stale SBOM entries on rescan instead of only upserting
- Add /api/v1/sbom/filters endpoint for dynamic filter options
- Make manager and license dropdowns dynamic from actual DB data
- Add cargo, npm, go, php, ruby, composer, bundler to Docker image

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-agent/src/api/routes.rs

@@ -36,6 +36,7 @@ pub fn build_router() -> Router {
             patch(handlers::update_finding_feedback),
         )
         .route("/api/v1/sbom", get(handlers::list_sbom))
+        .route("/api/v1/sbom/filters", get(handlers::sbom_filters))
         .route("/api/v1/sbom/export", get(handlers::export_sbom))
         .route("/api/v1/sbom/licenses", get(handlers::license_summary))
         .route("/api/v1/sbom/diff", get(handlers::sbom_diff))