run_plc_scan analyzed only the first PlcProject (or single code artifact), so a
target with several PLC artifacts (e.g. one PLCopen XML export per POU) had the
rest silently ignored. Found live: a target with pump_station.st + pump_fbd.xml
only produced findings for the first.
Iterate over every PlcProject / git repo / source-archive artifact on the target,
merge the control-logic findings, and union the control-app SBOM (deduped by
name+version) across all of them.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>