Add cfdp-eio, osv, and sbom.license libraries
cfdp-eio: CFDP file transfer over TCP with Eio. Drives Cfdp state
machines with real I/O — Sender (Class 1) and Receiver with
length-prefixed PDU framing. Same architecture as Borealis CFDP
service but using the standalone cfdp encode/decode API.
osv: OSV.dev vulnerability database client. Queries by Package URL,
ecosystem/name/version, or commit hash. Uses requests library for
HTTP. Maps CVSS scores to severity levels, supports batch queries.
sbom.license: SPDX license expression parser and policy evaluator.
Full Annex D grammar (AND/OR/WITH/+/LicenseRef, precedence, parens).
Policy engine with correct OR semantics (passes if any alternative
is acceptable). Built-in GPL and strong-copyleft deny lists.
Integration with Spdx.document and Cyclonedx.bom.
28 tests for sbom.license verified against Python license-expression
30.4 reference implementation: 50+ SPDX identifiers, operator
precedence, 18 real-world expressions (Linux kernel, Rust, npm,
Maven, Qt), error cases, SBOM integration with nested components.