Add support for CycloneDX 1.7

[coro]

Description of the PR

This PR adds support for ingestion of CycloneDX 1.7, by bumping cyclonedx-go to v0.11.0. This is needed as otherwise the version string 1.7 is rejected by the underlying library.

It also tests to ensure basic 1.7 SBOMs can be successfully processed and parsed. As for the new features of CDX 1.7:

• Support for Streebog hash algorithm
  • Tested this can be processed from the source SBOM and ends up in the dependency graph
• Citations, Patents, TLP distribution constraints
  • Added tests for SBOMs containing these fields but does not progress any of them to the graph
• New externalReference types
  • These are already ignored by GUAC so not handled as part of this PR

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If GraphQL schema is changed, GraphQL client updates/additions have been made
• If OpenAPI spec is changed, make generate has been run
• If ent schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[gaganhr94]

Thanks for the contribution. I have one small thought on the tests. What do you think about folding all the 1.7 constructs (Streebog + citations + patents + TLP) into a single JSON( just like how it was done for cdx-v1.4.json) and running it through the actual parser with some assertions ? With this, only a a single file gets added under testdata.

[coro]

@gaganhr94 Happy to do that. Have pushed an update to do so just now.