Make CyclondeDX SBOM processing language agnostic

[behnazh-w]

Right now the CycloneDX SBOM processor this line that group field exists for a software component.

key = f"{component.get('group')}:{component.get('name')}"

While this works for Maven packages, it might not work for other packages, such as Python, which do not have groups. We could use the purl field as the identifier. But because purl is also optional, we should use the other fields alternatively to account for that.

We need to make the CycloneDX SBOM processor language agnostic and use the official CycloneDX library to validate and deserialize BOM files. See the TODO item here.

[behnazh-w]

Closed via #748