feat(lab4): juice shop SBOM + grype and trivy comparison

[Mukhin-I]

Goal

Lab 4 - generate Syft SBOMs (CycloneDX + SPDX) of bkimminich/juice-shop:v20.0.0, scan the SBOM with Grype, compare against Trivy's all-in-one image scan, and produce a sign-ready in-toto/CycloneDX attestation for Lab 8.

Changes

• Added:
  • labs/lab4/juice-shop.cdx.json - CycloneDX 1.6 SBOM, 3068 components
  • labs/lab4/juice-shop.spdx.json - SPDX SBOM, 909 packages
  • labs/lab4/juice-shop-attestation.json — in-toto Statement v1 wrapping the CycloneDX predicate
  • submissions/lab4.md — full write-up (Task 1, Task 2, Bonus)

Testing

Commands run and observed output:

syft bkimminich/juice-shop:v20.0.0 -o cyclonedx-json=... -o spdx-json=...   # 3068 / 909
grype sbom:labs/lab4/juice-shop.cdx.json -o json                            # 104 findings (7 Crit / 51 High)
trivy image bkimminich/juice-shop:v20.0.0 --format json                     # 109 findings (5 Crit / 43 High)
docker inspect ... '{{index .RepoDigests 0}}'                               # sha256:fd58bdc9...
jq -n --slurpfile bom ... > juice-shop-attestation.json                     # in-toto v1 statement

Artifacts & Screenshots

• Submission: submissions/lab4.md
• Artifacts: labs/lab4/juice-shop.cdx.json, juice-shop.spdx.json, juice-shop-attestation.json

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed (SBOMs are deliverables; scan scratch is ignored)
• Submission file at submissions/lab4.md exists

---

PR Checklist

• Task 1 — Syft SBOMs + Grype scan + top-10 CVE analysis
• Task 2 — Trivy comparison + when-to-pick-each tradeoff
• Bonus — sign-ready CycloneDX attestation for Lab 8