How does Eracent SBOM-HQ SBOM Manager analyze open source vulnerabilities?