Extend test coverage to ensure we safely handle values from external sources

[heruan]

We get a lot of data from external sources, such as the generated SBOM, the OSV database, Flow releases and Security Team analysis. We need to extend our current test coverage to ensure those value are handled safely, e.g. to avoid NPE or parsing errors.