feat(sbom): add ecosystem canonicalization matrix

[stacknil]

Summary

• add an executable ecosystem canonicalization matrix for component identity
• keep PyPI, npm, Maven, NuGet, generic, and unknown-ecosystem behavior explicit instead of applying universal lowercase
• document the matrix and add a docs-sync test so registered rules stay documented

Validation

• python -m pytest tests/test_component_identity.py tests/test_diffing.py
• python -m pytest
• python -m ruff check src/sbom_diff_risk/component_identity.py tests/test_component_identity.py
• python scripts/regenerate-example-artifacts.py --check
• python scripts/validate-reviewer-routes.py
• python -m pip check
• git diff --cached --check
• python -m build --outdir .tmp-ecosystem-build