Parse CycloneDX Legal information

[pxp928]

Description of the PR

Update CDX parser to capture legal information that is contained in the SBOM. Unit tests have been updated to test the new functionality.

Related to the open issue: #1014, and completes the update to the CycloneDX Parser.

Updates were made based on the design doc: https://docs.google.com/document/d/1NmLlU5wuP2X9CK7QCWZkkOciNn1QFLKQCFCW9CEI8HQ/edit

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If GraphQL schema is changed, GraphQL client updates/additions have been made
• If OpenAPI spec is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[jeffmendoza]

Did you get small-legal-cyclonedx.json from somewhere? It seems to be not correct according to the spec.

name

"If SPDX does not define the license used, this field may be used to provide the license name"

[pxp928]

Did you get small-legal-cyclonedx.json from somewhere? It seems to be not correct according to the spec.

name

"If SPDX does not define the license used, this field may be used to provide the license name"

oh yeah its not real. I made it up to capture multiple usecases

[pxp928]

@jeffmendoza PTAL, I made the changes based on the comments and updated the unit tests.