VSYS-13506: Release CycloneDX doc reference after parse

[irenaliu18]

Summary

• clear the CycloneDX parser's retained document pointer after parsing so BOM bytes are eligible for GC

Predicates are the assembled ingestion inputs (nodes/edges) that the parser produces for the graph (packages, artifacts, licenses, SBOM edges, vuln metadata, VEX data, etc.). They’re for parsing and once built, they’re handed off to the assembler/backend, and the original BOM bytes are no longer needed.

Implications:
Memory lifecycle: The CycloneDX parser previously held onto the original *processor.Document (and its Blob). By clearing c.doc after predicates are built, we drop reference to the BOM buffer, letting GC reclaim it sooner during ingestion runs. This is for potential accumulation of large BOM byte slices in memory.
Scope: Change is confined to the CycloneDX parser. Outputs/predicates are unchanged; only the parser’s internal pointer is released.

Throughput/load scenarios: Under high-volume CycloneDX ingestion, earlier release of BOM memory can reduce peak heap and GC pressure. It does not change ingestion semantics or ordering, just retention behavior.

Limitations: This doesn’t address other possible retention sources (e.g., collectors, blobstore reads, NATS buffers). It’s a narrow fix for parser-held references in CycloneDX only. Additional profiling would still be needed to rule out other leaks.

[linear]

VSYS-13506 Investigate potential memory leak in vguac