Put the SBOM vulnerabilities before the per-tool sections

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -45,8 +45,8 @@ project page is left out. The report has these parts:
 
 1. the cover and a table of contents,
 2. a summary and the most critical issues across all sources,
-3. one section per SARIF run, named after its tool (e.g. CipherCell SAST, CipherCell Lynkeus),
-4. the dependency vulnerabilities from the VDR,
+3. the dependency vulnerabilities from the VDR,
+4. one section per SARIF run, named after its tool (e.g. CipherCell Lynkeus, CipherCell SAST),
 5. at the end, *False Positives and Suppressed Findings*: every result Polygraph classified as a
    false positive or that carries a SARIF suppression (such as the areas Lynkeus ruled out), with
    the reason.