Add support for CycloneDX SBOMs

[ejortega]

Add support for parsing CycloneDX SBOMs.

Documentation on v1.5 specs
https://cyclonedx.org/docs/1.5/json/
https://cyclonedx.org/docs/1.5/xml/

Added test files for v1.3, v1.2 and v1.5.

Note: optional dependencies are skipped for now. @louislang and @furi0us333 suggested adding a flag to include those does when specified by the user.

Closes #1188

Checklist

• Does this PR have an associated issue (i.e., closes #<issueNum> in description above)?
• Have you ensured that you have met the expected acceptance criteria?
• Have you created sufficient tests?
• Have you updated all affected documentation?
• Have you updated CHANGELOG.md (or extensions/CHANGELOG.md), if applicable

[maxrake]

I did add test files for v1.4 and v1.3 specs but couldn't find a v1.5 example.

Can one be generated from a common/popular project and then included here? It appears the cyclonedx-npm tool provided by CycloneDX has a --spec-version option that includes v1.5.

EDIT: Further investigation on that repo shows that they already have a collection of examples to demo all the features. There are v1.5 samples included in there.

[ejortega]

Thanks @maxrake, updated with those examples.

[cd-work]

300k lines of lockfiles seems a bit excessive to me. Do these files really bring 300k lines of benefit? I don't think we gain much by having excessively large lockfiles that just repeat the same thing over and over again and it would be really unfortunate to bloat up our repo through these.

Note these are currently our biggest lockfiles:

-rw-r--r-- 1 chris chris 3.7M May  2 14:56 spdx-2.3.spdx.json
-rw-r--r-- 1 chris chris 2.6M May  2 14:56 spdx-2.2.spdx
-rw-r--r-- 1 chris chris 1.7M Oct 13  2022 workspace-effective-pom.xml
-rw-r--r-- 1 chris chris 228K Feb 24 19:52 go.sum
-rw-r--r-- 1 chris chris 132K Jan 20  2023 Cargo_v3.lock

Where the 3.7M spdx lockfile is ~100k lines. This is a significant amount of disk space especially if anything ever changes about them (thus effectively doubling their size in the git history), and this can definitely impact git clone speed if it gets worse.

This patch changes the fixture directory size from 8.7M to 20M, more than doubling its size.