Optimize large SBOM parsing and encoding

[andrew]

Reduce CPU time and allocations when parsing and encoding large CycloneDX and SPDX documents. Pre-size model slices and indexes, avoid repeated string transformations, copy package metadata into exact-sized slices, and reduce envelope work while preserving depth limits and format detection.\n\nAdd benchmarks for large documents, flat and nested CycloneDX components, dense graphs, SPDX envelopes, parse-then-encode loops, and duplicate package identities.

[Copilot]

Pull request overview

This PR focuses on reducing CPU time and allocations when parsing and encoding large SPDX and CycloneDX SBOMs by pre-sizing core model slices/maps, avoiding repeated transformations, and streamlining SPDX envelope handling while preserving format detection and depth limits.

Changes:

• Introduces pre-sized SBOM construction (newSizedSBOM) and uses it in CycloneDX and SPDX parsing to cut allocations.
• Splits SPDX envelope handling into a dedicated spdxEnvelope + unwrapSPDXEnvelope, with detection carrying an spdxEnvelope flag.
• Optimizes encoding paths by pre-sizing output slices and avoiding repeated string/format work; adds targeted tests and expanded benchmarks for large/complex inputs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
spdx.go	Refactors SPDX parsing to unwrap envelopes up-front and pre-size SBOM structures and per-package slices.
sbom.go	Adds newSizedSBOM; refactors Detect into detect returning envelope metadata used by Parse.
encode.go	Pre-sizes encoded CycloneDX/SPDX structures and replaces repeated string conversions with targeted helpers.
encode_test.go	Adds a regression test for generated SPDX package IDs and relationship ordering.
cyclonedx.go	Pre-computes component/relationship counts for nested components, pre-sizes SBOM, and avoids append-driven growth.
cyclonedx_test.go	Adds coverage for parsed CycloneDX package metadata (type normalization, hashes, external refs, properties).
bench_test.go	Adds/expands benchmarks for large docs, nested components, dense graphs, envelopes, duplicates, and parse→encode loops.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.