add support for CDX "vulnerability" features

[jkowalleck]

• XML schema: https://github.com/CycloneDX/specification/blob/master/schema/ext/vulnerability-1.0.xsd
• docs: https://cyclonedx.org/ext/vulnerability/
• example: https://cyclonedx.org/use-cases/#vulnerability-disclosure

✋ issue: there is no JSON port for this extension - see CycloneDX/specification#37
🚧 unless we have a valid json schema for it, it is impossible to properly implement for all SBoM results

caused-by: CycloneDX/cyclonedx-php-composer#142