Fixed off by one error

[aidankeefe2022]

Fixed off by one error where when all ID elements are removed there was a 1/n ratio given by SBOMqs instead of the expected 0/n ratio. Where n is the total number of packages.

In the new code, the scores are still accurate, showing the ID feature's correct ratio.
When 0 elements are removed SBOMqs returned this ratio:

{
"category": "NTIA-minimum-elements",
"feature": "comp_with_uniq_ids",
"score": 9.375,
"max_score": 10,
"description": "15/16 have unique ID's",
"ignored": false
},

this ratio was verified by hand to be correct.

When 4 elements are removed,

"category": "NTIA-minimum-elements",
"feature": "comp_with_uniq_ids",
"score": 6.875,
"max_score": 10,
"description": "11/16 have unique ID's",
"ignored": false

The ratio is reduced by 4.

When all ID values are removed with the new change :

{
"category": "NTIA-minimum-elements",
"feature": "comp_with_uniq_ids",
"score": 0,
"max_score": 10,
"description": "0/16 have unique ID's",
"ignored": false
},

Again this was confirmed by hand.

In prechange code sometimes this ratio would be left as a 1/n. Now the ratio is reflective of the reality of the SBOM.

This was tested on 1000 SBOMs in CDX and SPDX generated by Trivy and Syft and scores are accurate and change with what is removed accurately in the ID field.

[riteshnoronha]

awesome will review. am out at the oss summit, will get to this tomorrow. Thanks for your contribution.

[riteshnoronha]

Approved. Thanks @aidankeefe2022