Improve SBOM graph VEX freshness gates

[danyili2632]

Summary

• add dependency graph completeness gates so flat-listed transitive components cannot be scored as complete SBOM evidence
• add VEX credibility fields for verification status, stale entries, verifier, and evidence reference
• add SBOM freshness and trustworthiness checks for age, CVE scan currency, build provenance, signer identity, and report output

Bounty

Addresses #1535.

I have read and agree to the CONTRIBUTING.md bounty terms. Preferred payment method can be provided privately after maintainer acceptance.

Validation

• git diff --check