✨ Adding CycloneDX 1.4 and 1.5 reporter

[marcwieserdev]

About this PR

This PR aims to add the CycloneDX 1.4 and 1.5 format. The idea behind it is to be able to export everything in a commonly used format to later reuse the result to enrich it. (ex: re-running a vulnerability matching process on the packages to find emerging vulnerabilities).

This PR adds 2 versions of CycloneDX even though at the moment they report the exact same thing.

In future PR, we intend to extract where packages has been found during the extraction process (file, line, column), which is an information only supported by CycloneDX 1.5.

We need a CycloneDX 1.4 format for backward compatibility reasons.

Additional informations

You may want to review this PR commit by commit, as it should be easier to read

[oliverchang]

thank you very much for contributing this! we'd love to support this feature in OSV-Scanner. I just have some comments.

[another-rex]

Thanks! I haven't had time to look into this recently, but I'll take a deeper look this week.

[another-rex]

Some minor comments, otherwise LGTM!

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 88.04781% with 30 lines in your changes missing coverage. Please review.

Please upload report for BASE (main@46aee59). Learn more about missing BASE report.
Report is 2 commits behind head on main.

Files	Patch %	Lines
pkg/reporter/sbom/cyclonedx_common.go	86.23%	12 Missing and 3 partials ⚠️
internal/utility/purl/purl.go	57.14%	7 Missing and 2 partials ⚠️
internal/utility/purl/package_grouper.go	91.17%	2 Missing and 1 partial ⚠️
pkg/reporter/cyclonedx.go	91.89%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1014   +/-   ##
=======================================
  Coverage        ?   65.74%           
=======================================
  Files           ?      159           
  Lines           ?    12776           
  Branches        ?        0           
=======================================
  Hits            ?     8400           
  Misses          ?     3905           
  Partials        ?      471           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[another-rex]

Thanks! Will aim to get this merged in next week.