feat: add extended support for Definitions

[hakandilek]

This PR builds on top of #701 to create extended elements for the bom.definitions.standards like:

• Requirements and
• Levels

depends on: #701
is part of: #696

[jkowalleck]

If a value was not provided in the constructor, a UUIDv4 will have been assigned.

has this been tested?

[hakandilek]

Now introduced some additional tests for this in cyclonedx/model/definition.py

[jkowalleck]

but still, there is not UUIDv4 assigned.

[jkowalleck]

just remove this line and you are good.

(just like it was removed in other places: #733)

[jkowalleck]

I mean, if you actually intended to have these bom-refs being non-null on rendering, like we do for components, then you should hook into BomRefDiscriminator.from_bom()

[hakandilek]

Ah ok, I see now your point.

I think assigning a non-required field automatically would cause a lot more problems in the downstream later on. I also do not have a scenario how to reference/use a bom-ref of a requirement elsewhere within the BOM. I'll just remove the lines.

[jkowalleck]

also do not have a scenario how to reference/use a bom-ref of a requirement elsewhere within the BOM.

Here is one: $.declarations.attestations[].map[].requirement - https://cyclonedx.org/docs/1.6/json/#declarations_attestations_items_map_items_requirement

The bom-ref to the requirement being attested to.

PS: This is in fact a very good reason to auto-populate this specific bom-refs on rendering. The same why we auto-populate bom-refs of components & services, as they could be used in a dependency tree.