docs(lab4): finalize SBOM and SCA analysis

[fayz131]

Goal

This pull request submits Lab 4 — SBOM Generation & Software Composition Analysis.
The goal of this lab was to generate SBOMs for OWASP Juice Shop, perform Software Composition Analysis, and compare specialized and all-in-one security toolchains.

Changes

• Generated SBOMs using Syft and Trivy
• Performed vulnerability analysis using Grype and Trivy
• Conducted license compliance analysis
• Executed secrets scanning
• Implemented quantitative comparison of detected packages and CVEs
• Added comprehensive analysis and recommendations in labs/submission4.md
• Included all generated reports and analysis artifacts

Testing

The following procedures were executed:

• SBOM generation via Docker containers:
  • anchore/syft
  • aquasec/trivy
• Vulnerability scanning:
  • anchore/grype using Syft SBOM
  • Trivy image scanning
• License and secrets scanning with Trivy
• Package and CVE overlap comparison using jq, sort, and comm

All commands completed successfully and reports were generated without errors.

Artifacts & Screenshots

Main artifacts included in this PR:

• labs/submission4.md
• SBOM reports (Syft & Trivy)
• Vulnerability reports (Grype & Trivy)
• License and secrets scan results
• Toolchain comparison analysis files

---

Checklist

• [✅ ] PR title is clear and descriptive
• [✅ ] Documentation updated if needed
• [✅ ] No secrets, temporary files, or large binaries included