fix: prevent panic when handling non YAML content

Using a new crate suggested by @jcrossley3

Author: helio-frota

Cargo.lock

@@ -117,7 +117,7 @@ serde = "1.0.183"
 serde-cyclonedx = "0.9.1"
 serde_json = "1.0.114"
 serde_with = "3.11.0"
-serde_yml = "0.0.12"
+serde_yml = { package = "serde_yaml_ng", version = "0.10" }
 sha2 = "0.10.8"
 spdx = "0.10.6"
 spdx-expression = "0.5.2"