fix(sbom): add missed primaryURL and source severity for CycloneDX

[DmitriyLewen]

Description

See #5372 for more details.

Changes:

• for table and json formats we use primaryURL. But CycloneDX doesn't have equivalent field. We can add primaryURL into advisories array.
• Save package-specific severity in VendorSeverity (for CycloneDX, there may be case where user can't understand why we use this severity).

Related issues

• Close bug(report): different values in vulnerability fields (Severity, links) for table, json and cyclonedx formats #5376

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen I've refactored a bit. Please let me know if I'm doing something wrong.

[DmitriyLewen]

@knqyf263 LGTM. Thanks for help!