A Field Guide to Threat Vectors in the Software Supply Chain