feat(sbom): mark only entry-point packages as directly attackable

[reyreavman]

Summary

sbom.gost.attackSurface: yes no longer lands on every package of an image. It now follows the dependency tree recorded in the SBOM dependencies section: components nothing else depends on keep yes, everything pulled in by another component is written as indirect.

Closes the DoD item «На основе информации о дереве зависимостей устанавливаем значение yes для gost_attack_surface» of card 69801379.

What

• gost.Upsert collects the targets of every dependsOn edge and writes indirect to the components that appear among them; the rest, and metadata.component, keep the configured value. Self-references do not demote their own subject.
• no and indirect, and securityFunction in all cases, apply unchanged to the whole tree — no behaviour change there.
• An empty dependencies section makes every component a root, so ecosystems whose catalogers report no tree keep exactly the previous output.
• Docs in both languages state the rule and the empty-tree case.

Why

Stamping yes on every package attests to a regulator that each of them exposes an interface an attacker reaches directly. The dependency tree is already in the SBOM — pm reports depends (pkg/sbom/packages/os_pm/os_pm.go:92) and syft emits dependencies for the ecosystems that have a resolver — so the distinction between what the image pulls in on purpose and what came along with it is available at build time.

VERIFIED

Two-image stapel build (base-layer: jq; app: curl, built fromImage base-layer) pushed to a local registry, werf sbom merge in both formats, output through 3p-ispras-sbom-checker:master:

container app        yes/no
  curl 8.12.1        yes/no        <- declared in packages, nothing depends on it
  jq 1.8.1           yes/no
  brotli, libc, libidn2, libpsl, libunistring, openssl, zstd   indirect/no
container base-layer yes/yes
  jq 1.8.1           yes/yes

--format container -> файл корректный; --format oss -> файл корректный. The container value is the maximum over its content, which the ISPRAS rule requires, and it is now satisfied by real roots rather than by uniform injection.

Mutation loop on the committed state — all caught:

mutation	failing specs
never demote (dependent := config)	3
demote everything (ignore the target set)	7
drop the self-reference guard	1
demote metadata.component too	1

task format, task build, task lint (0 issues), full task test:unit — green.

Review focus

• Only dependsOn is treated as an edge; provides is not. A component that merely provides an alias of another is still a root. Confirm that matches how the ISPRAS exporters read the tree.
• Ecosystems with no dependency tree (go-mod, python-pip — syft emits zero edges; measured 457 components / 0 edges for a real go.mod) degenerate to a uniform yes. Documented, not special-cased.
• Upsert also runs on base and imported BOMs (pkg/build/sbom_step.go), where the tree is that BOM's own. Values are recomputed on the merged result afterwards.

Depends on

Based on #329, not on main. Retarget once #329 lands.