refactor(sbom): use new metadata.tools struct for CycloneDX

[DmitriyLewen]

Description

1. Bump github.com/CycloneDX/cyclonedx-go to add support for metadata.tools.components (https://github.com/CycloneDX/cyclonedx-go/releases/tag/v0.8.0)
2. Use metadata.tools.components to save information about Trivy app.
3. Add support for both metadata.tools formats to save backward compatibility.

Before:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:79c0d7fe-5fb4-4134-8c13-ef12dc141b3f",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-22T08:35:46+00:00",
    "tools": [
      {
        "vendor": "aquasecurity",
        "name": "trivy",
        "version": "0.48.1"
      }
    ],
...

After

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:ec1f037f-cb4c-4d53-9908-33684e47c160",
  "version": 1,
  "metadata": {
    "timestamp": "2024-01-22T07:13:24+00:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "group": "aquasecurity",
          "name": "trivy",
          "version": "dev"
        }
      ]
    },
...

Related issues

• Close bug(sbom): SBOM Scanning does not support the new CycloneDX1.5 tools data structure. #5979

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen I've removed the warning message as Trivy should be able to scan CycloneDX v1.4 or below. Please let me know if I'm wrong.