fix: Add CycloneDX v1.5 writing

[spiffcs]

feat: Add CycloneDX support for older versons

grype alpine:3.18 -o cyclonedx-json@1.5

Supersedes #3176. Original work by @RossComputerGuy (Tristan Ross)
This branch is their commit rebased onto current main so it can be merged.

Authorship is preserved on the commit.

This PR also adds a small fix to the original feature that prevents a panic on an unsupported version.

Changes

No change in default behavior

$ grype alpine:3.18 -o cyclonedx-json | grep -m1 -E 'specVersion|schema'
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"specVersion": "1.6",

New feature: allow format to generate CycloneDX 1.5

$ grype alpine:3.18 -o cyclonedx-json@1.5 | grep -m1 -E 'specVersion|schema'
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"specVersion": "1.5",

Original PR: #3176

[spiffcs]

There was an update requested here by some members of the tools team. I'm going to take a stab at getting grype closer to how syft does formatting and rework this PR in that vein. Apologies for the delay.