transformer: handle null in src.url during deserialization

[secufoe]

Turns out that nix can produce a src field only containing "url": null. This leads to:

> Error: Failed to parse buildtime input
>
> Caused by:
>     invalid type: null, expected a string at line 335292 column 17

[secufoe]

I guess CycloneDX doesn't allow an empty URL: https://cyclonedx.org/docs/1.4/json/#externalReferences_items_url

[secufoe]

maybe this would be cleaner: https://docs.rs/serde_with/latest/serde_with/rust/double_option/index.html

[nikstur]

Thanks!