0.6.0

• Pin dependencies
• Recommend child-projects instead of fetching (#242)
• Show spinner when fetching (#264)
• Don't allow path traversal for dst path
• Check for casing issues in dst: path during update (#256)
• Check for overlapping destinations of projects (#173)
• Handle invalid metadata file (#280)
• Update to CycloneDX spec 1.3 (#282)
• Make it possible to generate jenkins and sarif json report for check (#18)