Put the SBOM vulnerabilities before the per-tool sections

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -45,8 +45,8 @@ project page is left out. The report has these parts:
 
 1. the cover and a table of contents,
 2. a summary and the most critical issues across all sources,
-3. one section per SARIF run, named after its tool (e.g. CipherCell SAST, CipherCell Lynkeus),
-4. the dependency vulnerabilities from the VDR,
+3. the dependency vulnerabilities from the VDR,
+4. one section per SARIF run, named after its tool (e.g. CipherCell Lynkeus, CipherCell SAST),
 5. at the end, *False Positives and Suppressed Findings*: every result Polygraph classified as a
    false positive or that carries a SARIF suppression (such as the areas Lynkeus ruled out), with
    the reason.

report_generator/context.py

@@ -90,7 +90,7 @@ def build_context(
         context["critical"] = critical
 
     if sca is not None:
-        context["sections"].append(_sca_section(sca))
+        context["sections"].insert(0, _sca_section(sca))
 
     set_aside = _set_aside_section(tools)