feat: surface specific SBOM validation errors from api

[v3nant]

Summary

• When hd scan eol submits an SBOM that eol-api rejects, show a specific, actionable message instead of the generic "Failed to submit scan to NES. Failed to create EOL report".

Changes

• Add a dedicated SBOM error-code group in src/api/errors.ts (SbomErrorCode, isSbomErrorCode, SbomError with optional details), kept separate from the auth ApiErrorCode / AUTH_ERROR_MESSAGES path.
• Preserve SBOM codes on the createReport path in src/api/nes.client.ts: extractSbomError() throws a SbomError carrying the API code, message, and details (purl, totalComponents); unrecognized codes still fall back to the generic error.
• Add CLI-friendly copy in src/commands/scan/eol.ts (SBOM_ERROR_MESSAGES + getSbomErrorMessage) covering EMPTY_SBOM, INVALID_SBOM_JSON, SBOM_MISSING_COMPONENTS, SBOM_NO_IDENTIFIABLE_COMPONENTS, and INVALID_PURL, with tool suggestions (Syft, cdxgen, Trivy) and --file vs generated-SBOM wording.
• Surface the message in the scan catch block and report the specific code as scan_failure_reason telemetry for SbomError failures.
• Add unit tests for code preservation/details in the client and for message selection, tailoring, purl interpolation, and unknown-code fallback.

Testing

• npm run typecheck
• npm run lint
• npm run test (24 files, 257 tests passing)

Screenshots

n/a

Risks & Rollback

• Low risk. The new messages only appear when eol-api returns one of the specific SBOM extensions.code values; any unlisted code (including the current prod BAD_USER_INPUT) keeps the existing generic fallback, so there is no regression.
• Dependency: the improved copy is only visible once eol-api is deployed to emit these codes. Verified end-to-end against prod by simulating the codes; prod currently still returns BAD_USER_INPUT for the no-purl case.
• Rollback: revert the commit; no data or schema changes.

Checklist

• Tests added or updated
• Linting passes
• Typecheck passes (if applicable)
• No breaking changes without clear migration notes
• Environment variables documented (if added/changed) — n/a