AI agent security needs a composition graph, not just an SBOM