feat: Deserializer/Denormalizer

[jkowalleck]

Context

Currently, we dont have deserializers.
Reason:

• XML: deserializition is complex and potentially insecure
• XML: no (native) deserializer exists
• having JSON deserializers and nothing for XML seams odd
• JSON deserializers require a lot of handcrafting due to the complexity of the spec

With the new CycloneDX 2.0 schemas, we might be able to finally provide proper deserialization.

• XML will be dropped
• JSON is less complex
• we might have the entire spec as models - chore: Automate data model generation from upcoming CycloneDX 2.0 machine-readable specification #1417

Goal

have JSON deserializers available

Related

• previous ticket: feat: Deserializer/Denormalizer #86