v0.6.0

Artifact integrity (JAR, wheel, sdist and npm .tgz checked against the registry's published checksum), a one-page executive summary for package inventories, and CycloneDX VEX export for Dependency-Track. See CHANGELOG.md.