[IXI-2773]

Two complete upstream Go CLI runtime imports

Verbatim copies from CarterPerez-dev/Cybersecurity-Projects at pinned commit 6c8ac85; upstream Go source credits ©AngelaMos (2026), AGPL-3.0-or-later.

• third_party/community/docker-security-audit/ — 32 upstream files: 27 Go runtime files (cmd, internal), Dockerfile, go.mod, go.sum, README, AGPL license.
• third_party/community/sbom-generator-vulnerability-matcher/ — 34 upstream files: 30 Go runtime files (cmd, internal, pkg), go.mod, go.sum, README, AGPL license.

66/66 exact upstream Git blob hashes confirmed, both in fetched source and in the assembled import tree. No modifications to third-party runtime source. Upstream tests, fixtures, install scripts and learning modules omitted; original source links remain in the docs.

Repository integration

• Adds the two tools to third_party/community/imports.json, root README, third-party credits and community usage guide.
• Extends the existing pin/hash checker to recognize seven community copies.
• Preserves third_party/imports.json and previous evidence-bound receipts without edits.
• The existing scoped .gitattributes rule already guards community byte identity on Windows.

Verification limits

• Python check confirmed 66/66 original bytes and path manifest consistency; import checker passed AST parsing.
• GitHub catalog check awaited separately.
• No Go build or runtime test: Go compiler is unavailable in this execution environment. No Docker daemon connection, OSV/NVD query, dependency installation, or full test suite was performed. Run only on authorized systems and review source before operational use.