Downgrade Adapters (SC4)

• Location for mapping CSVs converting CVSS v4→v3.1, CDX 1.7→1.6, SLSA 1.2→1.0.
• Each CSV must include BLAKE3 and SHA256 hash recorded in accompanying hashes.txt.
• Adapters are pure (no network); determinism enforced in CI.
• Files added:
  • mapping-cvss4-to-cvss3.csv
  • mapping-slsa12-to-slsa10.csv
  • mapping-cdx17-to-cdx16.csv (placeholder empty; fill once downgrade rules freeze).