fix(sbom): apply and check GOST properties on nested components too

[reyreavman]

Summary

build.sbom.gost.* reached only metadata.component and the top-level components list. A base or imported SBOM carrying nested components kept whatever values it had below the first level, passed the GOST gate with properties missing there, and in the container-format product SBOM the container value ignored everything below the top level. Stacked on #321.

What

• gost.Upsert sets GOST:attack_surface / GOST:security_function on every component at any nesting depth — under components and under metadata.component.components alike — not only the top level.
• gost.Validate fails with component "<name>": missing mandatory GOST properties for a nested component without them; previously nested components were never inspected.
• In a container-format product SBOM the container's GOST values are the maximum over all descendants transitively, per field; previously the maximum over direct children only.
• VERIFIED: on a two-image stapel product the merged container SBOM still passes 3p-ispras-sbom-checker --format container (файл корректный) with the container values unchanged, as expected for the flat component lists syft emits.
• No change for SBOMs without nested components: syft does not emit nesting, so current outputs are byte-identical apart from serial number and timestamp.
• Deliberately unchanged: which value the container receives when the config sets it explicitly — setMissingGOSTOnComponent still prefers the value already on the image root. The model question (whether the container is always derived or may be set) is open on the tracking card and not decided here.

Why

Upsert and Validate iterated bom.Components one level deep, and aggregateGOST read only the slice it was handed. A nested component was therefore invisible to all three: it kept foreign values from its origin SBOM, was not validated, and did not participate in the container maximum. The ISPRAS checker enforces container == max(all descendants) for both fields, so a nested yes under a container computed as indirect is a hard ERROR at submission time, while our own validation stayed silent.

Alternative considered: leaving Upsert shallow and only making aggregateGOST transitive. Rejected: the gate would then accept an SBOM whose nested components lack the properties entirely, and the checker treats a missing property as invalid.

[reyreavman]

Verification

• Mutation: recursion removed from Upsert → Gost SBOM setter Set should set GOST properties on nested components fails; from Validate → should fail if GOST properties are missing in nested components fails (Expected an error, got nil); from aggregateGOST → higher value only in a grandchild and fields are aggregated independently fail. All three observed before the fix landed.
• Hand-run: werf sbom merge --ispras-format container on a two-image stapel product with the new binary, then 3p-ispras-sbom-checker --format container → файл корректный.

Follow-up

• BLOCKER: fix(sbom): keep the dependency graph intact in container-format product SBOM #321 merges first; this PR is rebased onto main afterwards (base is currently fix/sbom/product-deps-refs).

[reyreavman]

Independent review (gpt, read-only) + mutation loop

Review verdict: approve, one Minor finding — Upsert/Validate did not descend into metadata.component.components, so "every component at any nesting depth" in the description was not strictly true. Fixed in 2308ad5: both functions now walk that subtree; two new table entries (should set GOST properties on components nested under the metadata component, should fail if GOST properties are missing in components nested under the metadata component) failed before the fix and pass after.

Mutation loop run by hand on the PR head, each mutation restored afterwards:

Mutation	Failing test
recursion removed from setComponents	should set GOST properties on nested components
recursion removed from validateComponents	should fail if GOST properties are missing in nested components
recursion removed from aggregateGOST	higher value only in a grandchild, fields are aggregated independently
nested max fields swapped in aggregateGOST	fields are aggregated independently
setComponents iterating by value	3 Upsert entries incl. the nested one

Reviewer's other notes, not acted on: nested error message does not carry the parent path (same as before for top-level duplicates); withGOST helper lives inline in gost_test.go, matching container_test.go in the same package.