New features

kosli snapshot s3: added --download-concurrency and --download-budget flags to control parallel downloads and peak temporary disk usage when fingerprinting S3 buckets.
kosli attest sonar: --sonar-revision can now be used together with --pull-request; when provided, the command fails if the pull request's latest analysis is not of the specified revision.

Improvements

kosli snapshot s3: S3 object keys are no longer used as local file names; each object is downloaded to a temporary file, hashed, and removed, so any valid S3 key can be fingerprinted on any OS.
kosli get flow and kosli list flows: the Visibility field is no longer shown in table output (it is a legacy field with no effect on access).
kosli list flows: fixed a panic when a flow has no tags.

ci(kosli): attest SBOMs with the sbom type by @AlexKantor87 in #1186
feat(snapshot s3): fingerprint S3 buckets from a virtual tree by @mbevc1 in #1180
fix(ci): wait for staging to settle before picking a server image by @AlexKantor87 in #1190
feat(snapshot s3): download objects in parallel within a count and byte budget by @mbevc1 in #1191
feat: allow --sonar-revision with --pull-request to validate analysis commit by @mbevc1 in #1193
chore(list-flows): drop the VISIBILITY column from the table output by @dangrondahl in #1187
chore(get-flow): drop the Visibility row from the table output by @dangrondahl in #1188
fix(snapshot k8s): do not abort the snapshot when a Running pod has an empty imageID by @dangrondahl in #1195
test(fingerprint): cover OCI capture cleanliness against a fake registry by @mbevc1 in #1197

Full Changelog: v2.41.0...v2.42.0