Ingest an SBOM into GUAC and query the dependency graph for known vulnerabilities affecting a package

Verified steps

1. Stand up the GUAC service infrastructure via the documented Docker Compose setup and ensure the guacone binary is on PATH.
2. Ingest an SBOM file into the GUAC graph with guacone collect files <path-to-sbom>, or use guacone collect --add-vuln-on-ingest files <path-to-sbom> to also query OSV for vulnerability data during ingestion (slower due to rate limits).
3. If vulnerability data wasn't pulled at ingest time, run the OSV certifier explicitly with guacone certifier osv to populate vulnerability certifications for the ingested packages; it also runs continuously in polling mode on an interval when part of the running compose stack.
4. Query for vulnerabilities on a specific artifact with guacone query vuln purl "pkg:..." (using the package's pURL) or guacone query vuln uri "<sbom-namespace-or-serialNumber>" (SPDX documentNamespace or CycloneDX serialNumber) — this syntax requires GUAC v0.8.9 or later.
5. To check whether a specific vulnerability affects the artifact and see the dependency path to it, add --vuln-id "<CVE-or-GHSA-id>" to the query (optionally --num-path N to limit the number of paths returned).
6. If a query reports missing/incomplete vulnerability certification data, re-run guacone certifier osv to force an immediate re-scan before retrying the query.