Quote "$@" in gen-sbom --srcs (drop SC2068 disables), pass JSON paths to
python via env var in validate.sh to prevent filename injection, and fail
non-zero instead of warning when SBOM post-processing breaks. Rename the
user_settings.h guard to CRA_KIT_USER_SETTINGS_H, clarify the serialNumber
regex accepts v4 (product) and v5 (component) UUIDs, untrack the gitignored
embedded sample SBOMs, document the SHA-512 CBOM omission, and note sample
timestamp differences in SAMPLE-PROVENANCE.md.
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>