Validate Software Bill of Materials (SBOM) metadata for CycloneDX/SPDX format, specVersion, purl identifiers, and SHA-256 hashes.