Please address the comments from this code review:

## Overall Comments
- In `matcherService.ScanSBOM`, the media type passed to `sbomer.Decode` is not normalized the same way as in `ValidateScanSBOMRequest`, so a value like `"application/spdx+json; charset=utf-8"` will pass validation but fail decoding; consider reusing the same normalization (e.g., `strings.TrimSpace(strings.Split(mediaType, ";")[0])`) before calling `Decode`.
- The change in `Backends.APIServices` to only pass `RemoteIndexer` as the `ReportProvider` (and no longer fall back to the local `Indexer`) means `matcherService` may have a nil `indexer` even when a local indexer exists, which can break `GetSBOM`/`ScanSBOM` behavior and empty-contents handling; please confirm whether this fallback is intentionally removed or restore the local indexer as the provider when no remote indexer is configured.

## Individual Comments

### Comment 1
<location path="scanner/sbom/sbom.go" line_range="136-137" />
<code_context>
+
+// Decode decodes an SBOM into an IndexReport.
+// The mediaType specifies the format of the SBOM (e.g., "application/spdx+json").
+func (s *SBOMer) Decode(ctx context.Context, sbomData []byte, mediaType string) (*claircore.IndexReport, error) {
+	switch mediaType {
+	case MediaTypeSPDXJSON, MediaTypeSPDXText:
+		return s.decodeSPDX(ctx, sbomData)
</code_context>
<issue_to_address>
**issue (bug_risk):** Media type handling in Decode is inconsistent with validator and will reject valid values with parameters

`Decode` compares `mediaType` verbatim to `MediaTypeSPDXJSON`/`MediaTypeSPDXText`, but `ValidateScanSBOMRequest` normalizes the value (trims whitespace and strips parameters like `; charset=utf-8`). Since `ScanSBOM` passes `req.GetMediaType()` directly into `Decode`, a value such as `application/spdx+json; charset=utf-8` will validate but still be rejected here. Please normalize `mediaType` in `Decode` (or pass the normalized value from the caller) to keep behavior consistent and avoid rejecting valid requests.
</issue_to_address>

### Comment 2
<location path="scanner/cmd/scanner/main.go" line_range="261-264" />
<code_context>
 		srvs = append(srvs, services.NewIndexerService(b.Indexer))
 	}
 	if b.Matcher != nil {
-		// Set the index report getter to the remote indexer if available, otherwise the
-		// local indexer. A nil getter is ok, see implementation.
-		var getter indexer.ReportGetter
-		getter = b.RemoteIndexer
-		if getter == nil {
-			getter = b.Indexer
+		// Set the report provider to the remote indexer if available, otherwise the
+		// local indexer. A nil provider is ok, see implementation.
+		var provider indexer.ReportProvider
+		if b.RemoteIndexer != nil {
+			provider = b.RemoteIndexer
</code_context>
<issue_to_address>
**issue (bug_risk):** Dropping the local indexer fallback can leave matcherService without an indexer, breaking GetSBOM and enrich flows

Previously, matcherService always had an index provider by falling back to `b.Indexer` when `b.RemoteIndexer` was nil. Now `provider` is only set when `b.RemoteIndexer != nil`, so in deployments with only a local indexer `matcherService.indexer` (and thus `GetSBOM`/enrich) will see a nil provider, risking panics or incorrect `disableEmptyContents` behavior. Please restore the fallback to `b.Indexer` when no remote indexer is configured, while still allowing `ReportProvider` to be nil only when those features are intentionally disabled.
</issue_to_address>