Add support for serde traits to cyclonedx-bom types

[Naxdy]

Though the intended way to interact with the crate is to use the individual serialization functions for the different specs, sometimes it is desirable to parse into the main types directly when working with custom intermediate formats, or to only (de-)serialize part of a BOM (e.g. only vulnerabilities).

This PR adds optional Serialize and Deserialize derives to the main Bom struct and all others that require it, but only when compiling with the serde feature. The serde feature is opt-in, so as to preserve the current default behavior, and avoid potentially confusing new users with the intended usage.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 4 duplication

Metric	Results
Complexity	0
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Shnatsel]

Could you explain the motivation behind this change?

This looks like a different take on #802 but I'd like to hear what your use cases are like.

[Naxdy]

Our use case is an SBOM generation tool that supports merging the final BOM with manual annotations. Currently this includes VEX metadata and subcomponents. Our data sources output partial data that we would like to deserialize into the cyclonedx_bom types and merge them with the types we construct within our Rust code.

Currently, we're using our own newtypes and have impl From<OurType> for CycloneDxType blocks for every corresponding type. As you can imagine, this is quite the effort to maintain.

The alternative would be to parse into the parent Bom type directly, but that would require us to extract the subtypes we care about and perform a lot of unnecessary pattern matching around Options when we know we won't need it.

Basically, we'd like to be able to do something like this:

#[derive(Serialize, Deserialize)]
struct CustomMeta {
  vulnerabilities: Vec<Vulnerability>,
  subcomponents: Vec<Component>,
  // ...
}

---

As a side note, @RossComputerGuy is a colleague of mine, and the SBOM tool referenced in #802 and in this comment are one and the same.