[Composition Analysis] Make SBOM occurrence query layer tracked-context aware for reachability

Part of &21396 (Complete at Scale Vulnerability Management).

Problem

Reachability is stored on sbom_occurrences (project-global). To support reachability per tracked branch, the SBOM query layer must be able to scope occurrences to a tracked context via Sbom::OccurrenceRef.project_tracked_context_id.

Scope

Add a context-aware scope/method on Sbom::Occurrence (e.g. for_tracked_context(context)) that joins through sbom_occurrence_refs, so callers can retrieve reachability for a specific branch.

This does not change Vulnerability#reachability or GraphQL — see the companion issue for the Vulnerability/GraphQL consumer changes.

Dependencies

  • Depends on the backfill of sbom_occurrences_vulnerabilities.vulnerability_occurrence_id (companion BBM issue).

Out of scope

  • Vulnerability#reachability and VulnerabilityType GraphQL BatchLoader changes (tracked in companion issue).