docs(supply-chain): guide suppliers to automated requirement validation

[haksungjang]

Summary

The pre-submission checklist page offered only the CycloneDX Validator as a validation tool. That tool performs schema validation — a file can pass it while still missing the required fields, PURLs, and transitive dependencies that get a submission rejected — so suppliers were left verifying those items by hand with jq.

Changes (ko/en mirrored)

• checklist.md: replace the single-tool section with a two-part "Validation Tools" section.
  • BomLens automated validation (recommended, v1.8.0+): the --analyze command a supplier runs on their SBOM before submitting, a table mapping the conformance-report checks to checklist items 2–4 (spec version range, required metadata, name/version, dependency completeness, PURL coverage/format/no-generic), and a note that a fail lists the offending components. The web UI upload path is mentioned as an equivalent.
  • CycloneDX Validator (schema check): kept, with its scope stated — format/syntax checks (checklist item 1) only, no SPDX support, and passing it does not imply the submission requirements are met.
  • The checklist intro points to the tools section so suppliers see the automated path first.
• requirements.md: the related-documents link to the checklist now mentions both validation tools.

Verification

• Hugo build passes locally.
• Korean style lint: 0 findings on the changed pages.