chore: pin bomly-sdk v0.4.1

Picks up numeric port normalization, so one port written two ways -- ":0443"
and ":443", or ":08443" and ":8443" -- is one location rather than a
disagreement that discards a valid origin. Also carries the LICENSE fix that
makes the module's Apache-2.0 licence machine-detectable, which is what the
code-scanning alert on this PR was reporting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: bomly-guy

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
-	github.com/bomly-dev/bomly-sdk v0.4.0
+	github.com/bomly-dev/bomly-sdk v0.4.1
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect

go.sum

@@ -257,8 +257,8 @@ github.com/bomly-dev/bomly-plugin-scorecard-matcher v0.1.0 h1:Vyz2qtHvqGK1Wi+cai
 github.com/bomly-dev/bomly-plugin-scorecard-matcher v0.1.0/go.mod h1:N51fXsuj0NhJtCmqiL3fM7+XRPNDg7a8s9boJWrg670=
 github.com/bomly-dev/bomly-plugin-syft-detector v0.1.0 h1:izjWbFILBnjSrRyCwBQS2dtDYy70RfDBgR8/2aRIZcQ=
 github.com/bomly-dev/bomly-plugin-syft-detector v0.1.0/go.mod h1:uLBBHXzEJaNczZAyTIZjxfTSDoU+yLVC36qBE+vIAyk=
-github.com/bomly-dev/bomly-sdk v0.4.0 h1:C+3gOVF6KFZ8KOq4jV94snP+qn8s1QzxG8PhE30yDaI=
-github.com/bomly-dev/bomly-sdk v0.4.0/go.mod h1:yn1LBkoHG9gDBXKyRj0UNJo0BlXl8Bj9Ymb3WKLIh78=
+github.com/bomly-dev/bomly-sdk v0.4.1 h1:Gg5iJtyXcfJkmfjs9jDzOu2JNHxMv+b2tz0SL+g47ts=
+github.com/bomly-dev/bomly-sdk v0.4.1/go.mod h1:yn1LBkoHG9gDBXKyRj0UNJo0BlXl8Bj9Ymb3WKLIh78=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
 github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=