Use shared integrity module

[andrew]

Use github.com/git-pkgs/integrity for SRI parsing and preserve every supported digest when reading and writing CycloneDX lockfiles. The old pin/integrity package is removed.

Closes #34

[Copilot]

Pull request overview

This pull request migrates CycloneDX lockfile SRI handling to the shared github.com/git-pkgs/integrity module, enabling round-tripping of multiple supported SRI digests while keeping pin/integrity as deprecated compatibility wrappers.

Changes:

• Switch CycloneDX lockfile read/write to use github.com/git-pkgs/integrity, preserving multiple SRI digests for both file and package hashes.
• Add CycloneDX tests covering multi-hash round-trip, malformed supported hashes rejection, and ignoring unsupported hashes.
• Replace pin/integrity implementation with thin deprecated wrappers and remove associated fuzz/bench tests; add the new shared module dependency.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Makefile	Removes fuzz targets for the legacy integrity package (tests were removed).
lock/cyclonedx.go	Uses shared integrity parsing/formatting and supports encoding/decoding multiple hashes.
lock/cyclonedx_test.go	Adds coverage for multi-hash round-trips and hash validation behavior.
integrity/sri.go	Converts legacy SRI helpers into deprecated wrappers over the shared module.
integrity/sri_test.go	Adds a test ensuring legacy ParseSRI returns the first digest from multi-hash input.
integrity/fuzz_test.go	Removes fuzz tests for legacy integrity implementation.
integrity/bench_test.go	Removes benchmarks for legacy integrity implementation.
go.mod	Adds dependency on github.com/git-pkgs/integrity v0.1.0.
go.sum	Adds checksums for github.com/git-pkgs/integrity v0.1.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.