SBOM diff checker

Components match on package URL: the purl with its version, qualifiers and fragment stripped, case-folded. A component with no purl falls back to its name, and the row says so. Versions compare under SemVer 2.0.0 when both sides parse; otherwise the row reads "changed, not comparable". SPDX tag-value (.spdx) files are not supported, and purl percent-escapes are not decoded. This is a structural diff only. It does not consult vulnerability feeds, license compliance lists, or dependency graphs, so a clean diff is not a clean bill of health.