test(sbom): pin declared-dependency SBOM for native Maven uploads (#870)

[brandonrc]

Summary

Adds a release-gate E2E that pins the declared-dependency SBOM invariant for native Maven uploads, the exact gap #220 describes.

A Maven jar PUT does not trigger a scan, so there are no scan_packages rows. Before the fix the SBOM read path returned an empty component list, and a customer fetched "components": [] for an artifact whose POM names real dependencies. The companion backend fix (artifact-keeper#1553, closes artifact-keeper#870) adds a declared-dependency source so the SBOM is populated from the POM regardless of scanning. This test pins that behavior.

What the test does (tests/security/test-sbom-declared-deps.sh)

Publishes a placeholder jar plus a POM declaring two compile dependencies (one ${property}-versioned, one literal) and one test-scoped dependency, then asserts:

• POST /api/v1/sbom returns component_count >= 2
• the property-versioned guava resolves to pkg:maven/com.google.guava/guava@32.1.3-jre (exercises the storage POM fallback and <properties> interpolation in the backend fix)
• commons-lang3 appears with its maven purl
• the test-scoped junit-jupiter is excluded
• the document carries a declared/partial completeness signal, never an authoritative complete with an empty inventory

Why it complements the existing gate

tests/release-gate/sbom-correctness-gate.sh covers the npm + lockfile, scanner-derived path. This covers the opposite case the existing gate cannot: declared dependencies with no scanner inventory at all.

Portability

Gated behind a new require_feature "sbom_declared_dependencies" flag (min backend 1.2.0, registered in tests/lib/common.sh) so pre-1.2.0 backends skip loudly instead of flapping on the structurally-empty case. The test is auto-discovered by the security suite, which release-gate.yml already runs.

Note: #220 was written assuming this slipped to v1.2.1. The backend fix landed for v1.2.0 (artifact-keeper#1553), so the feature gate targets 1.2.0.

Validation

• bash -n: clean
• shellcheck tests/security/test-sbom-declared-deps.sh: clean (exit 0)
• Live run pending a backend image built from artifact-keeper#1553; the test skips on backends that predate the fix.

Closes #220