Fix SBOM size validation to check before reading file

[Copilot]

Addresses feedback from #347 where parseSBOMFromPath reads the entire file before checking size, defeating the 16MB guard for memory protection.

Changes:

• Check file size with fs.stat() before fs.readFile() to prevent loading oversized files into memory
• Handle ENOENT explicitly with "SBOM file not found" error instead of exposing system error codes
• Update test expectations for new error message

Before:

export const parseSBOMFromPath = async (filePath: string): Promise<SBOM> => {
  const fileContent = await fs.readFile(filePath, 'utf8')  // Reads entire file first
  
  const stats = await fs.stat(filePath)
  if (stats.size > MAX_SBOM_SIZE_BYTES) {  // Too late
    throw new Error(...)
  }
  // ...
}

After:

export const parseSBOMFromPath = async (filePath: string): Promise<SBOM> => {
  let stats
  try {
    stats = await fs.stat(filePath)  // Check size first
  } catch (error) {
    const err = error as NodeJS.ErrnoException
    if (err.code === 'ENOENT') {
      throw new Error('SBOM file not found')
    }
    throw error
  }

  if (stats.size > MAX_SBOM_SIZE_BYTES) {  // Guard works correctly now
    throw new Error(...)
  }

  const fileContent = await fs.readFile(filePath, 'utf8')  // Only read valid files
  // ...
}

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[bdehamer]

cherry-picked into #347