fix(cyclonedx): include CVSS v4 vulnerability ratings

[drawliin]

Description

Add CycloneDX vulnerability rating generation for CVSS v4.

Previously, when a vulnerability had a CVSS entry with only V40Score and V40Vector, CycloneDX output produced an empty ratings array because only v2 and v3 ratings were handled in pkg/sbom/cyclonedx/marshal.go.

This change adds CVSS v4 rating support so v4-only vulnerabilities are included in CycloneDX vulnerability output.

Related issues

• Close #XXX

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[CLAassistant]

All committers have signed the CLA.