Ingest tool data from metadata.tools and make it available in CEL policies

[nscuro]

Users may wish to access information about the tooling that generated a BOM in their policies. CycloneDX BOMs include this info in the metadata.tools node. However, it is not currently ingested by Dependency-Track.

As per vanilla DT 4.10.0, metadata.supplier and metadata.manufacturer are already ingested:

• Add missing support for supplier and manufacturer dependency-track#2737
• Issue #2737 - Fulfil NTIA minimum requirements dependency-track#3090
• Supplier and manufacturer corrections dependency-track#3179
• Add support for project and component suppliers frontend#646

These changes haven't been ported to Hyades yet (#983). We should do that before adding the tooling part, to ensure we're not deviating implementation-wise.

Warning

metadata.tools[] was deprecated in favor of metadata.tools.components[] and metadata.tools.services[] in CycloneDX 1.5. We need to ensure that we can handle both, and our internal data model should likely reflect the new representation.