Using SBOMs for Application Security