Support additional external references on main artifact

[ppkarwasz]

Version 1.5 of CycloneDX introduces new interesting external reference types, such as vulnerability-assertion (VEX), exploitability-statement (VDR) or static-analysis-report.

It would be useful to be able to add such references to the main component of the SBOM through a plugin configuration like this:

<configuration>
  <externalReferences>
    <reference type="exploitability-statement">
      <url>https://...</url>
    </reference>
  </externalReferences>
</configuration>

(the proposed schema is identical to the CycloneDX schema).

This configuration would apply add additional <reference> elements:

• for simple SBOMs only to the /metadata/component/externalReferences element of the SBOM,
• for aggregate SBOMs also to the /components/component/externalReferences elements representing Maven modules.

Such a feature could easily replace #414.

[hboutemy]

done in #428