Shift Left, Secure Right: Building an Open Source SBOM-driven Vulnerability Management System