Handle filename collisions in validation

[pownkel]

Linux filesystems are case-sensitive, but Windows filesystems are not, and the SBOM validator follows the case sensitivity of whichever filesystem it runs on. As a result, if an SBOM is generated on Linux and contains files called, for example, filename and FileName, and we attempt to validate that SBOM on Windows, the validator tool sees the same filename twice with different hashes.

Currently if this happens, we add null to a dictionary of file hashes, but since we do not check for null when that dictionary is used, the user sees the message Object reference not set to an instance of an object, which doesn't give any clues about what happened.

When this happens, we should output a more meaningful error, ideally one prompting the user to make sure the validator runs on the same OS that the SBOM was generated on.

[DaveTryon]

This has been merged to main and will be included in our next release