This would indeed simplify the code, but:

• as you can see here, "http://" should be considered as valid. It's not by the new code, but to be honest, it was not by the previous code either. Anyway, in worst case, we remove something that should have been valid but don't break CycloneDX spec
• " https://gitlab.com/behat-chrome/chrome-mink-driver.git " should be considered as invalid. It's not by the new code and was correctly handled by the previous one. So it would produce invalid SBOM.

I suppose there's plenty of other cases where there's false positive/negatives.
Maybe a better solution would be to try to fix validate-iri lib to prevent infinite regex analysis?

Regarding 2, we always trim before validation so the given test case may not happen?

The inspiration is to go for max validation without complex regex. I found validate-iri to be too complex to fix.

Do we put the trimmed value in the SBOM or the original value?

We put the trimmed value. So it looks OK for me.