Web: SBOM/VEX inputs on the scan form (follow-up to S5) #32

Follow-up from the S5 review (#13, PR #30): the web page should let a reviewer supply an SBOM/VEX alongside the URL.

Scope: add two optional inputs to the scan form from #28 (web/src/components/scan-form.tsx): an SBOM/VEX URL and a pasted or uploaded document. They map to the existing ScanRequest.sbom_url (field 3) and sbom_document (field 4), sent through the existing request builder in web/src/lib/api.ts. Enforce the 2 MiB document cap in the UI, and show the confidence the report assigns to supplied evidence.

Depends on: #28 (the web page) and #30 (the CLI/service path and the request fields' behavior) being merged.

Acceptance:

• The form submits sbom_url / sbom_document; a report built from a supplied SBOM shows High confidence with the SBOM_SUPPLIED evidence.
• A document over 2 MiB is rejected in the form before sending.
• Component tests cover both inputs and the oversize rejection.
• README.md documents the new inputs.

Blocked by: #9, #13