Overview

Vulnerability tickets for third-party dependencies are routed by internal:team_responsible on the component in Dependency-Track. Only components with an explicit owner have it, so vulnerabilities in their direct and transitive dependencies (for example the 219 dependencies of pkg:maven/com.mongodb.streams/aspio, owned by Atlas Stream Processing Engine) fall back to Server Triage.

Scope of Work

* buildscripts/sbom/sbom_utils.py: add propagate_team_ownership(), which walks the CycloneDX dependencies graph and gives an untagged component the owner of its nearest owned ancestors only when they all belong to the same single team. Existing owners are never changed and act as boundaries. It is ecosystem-agnostic and idempotent.
* Dependencies consumed by more than one team keep team_responsible unset, so they still default to Server Triage (confirmed acceptable). The consuming teams are recorded in internal:team_consumers as one alphabetical string joined by |. team_responsible is never multi-valued for inferred owners because Dependency-Track returns properties in no guaranteed order and Mothra uses the first one.
* Add internal:team_responsible_source to every owner: master:buildscripts/sbom/metadata.cdx.yaml, master:buildscripts/sbom/metadata.cdx.yaml#branchOverrides, CODEOWNERS: or inherited:.
* buildscripts/sbom/generate_sbom.py: record the source at the branchOverrides and CODEOWNERS sites and run the propagation after the dependency graph is built, before the public SBOM strips internal: properties.
* buildscripts/sbom/README.md and buildscripts/tests/test_generate_sbom.py: documentation and unit tests.

Acceptance Criteria

* Against the current sbom.private.json the 219 aspio dependencies are assigned to Atlas Stream Processing Engine and no existing owner changes.
* Unit tests pass.

Follow-up

RNDSEC-5060 (Mothra) will surface internal:team_consumers in the VULN ticket. This change must land first.