CDX 1.4, Initial support

[jonringer]

Get vulnerabilities enumerated for CDX 1.4 scans.

I did check this was CDX 1.4 compliant (which it is), but still missing a signatures field. However, a lot of CDX additions are optional. And support for signatures can be added later.

[jonringer]

Not sure why this wasn't failing before, but one of the tests:

$ grype sbom:/tmp/vulnxscan_s3qknbz3.json --add-cpes-if-none --output json
 ✔ Vulnerability DB                [no update available]  
A newer version of grype is available for download: 0.81.0 (installed version is 0.74.7)
failed to catalog: unable to decode sbom: unable to decode cyclonedx json document: json: cannot unmarshal number into Go struct field Property.metadata.properties.value of type string

  "metadata": {
    "timestamp": "2024-09-30T11:52:25.233952-07:00",
    "properties": [
      {
        "name": "sbom_type",
        "value": "runtime_only"
      },
      {
        "name": "sbom_dependencies_depth",
        "value": 1
      }
    ],

This seems to align with the upstream spec: https://cyclonedx.org/docs/1.4/json/#metadata_properties_items_value

[henrirosten]

> Not sure why this wasn't failing before, but one of the tests:

I also notice grype doesn't like the vulnerabilities section in the input sbom.

Please see the two commits I added on top of yours in #129, which gets rid of this problem. Also, they fix the github tests and makes them check the schema matches cdx 1.4.

Feel free to cherry-pick or just copy the necessary parts of the changes from #129 to this PR if it helps.

[jonringer]

Yea, the commits look fine to me

[jonringer]

Thanks for fixing up the tests, and making vulnerabilities optional :)