feat: upgrade CycloneDX lib 10.0.0

[jkowalleck]

Description

• Fixed
  • Qualified PackageURLs
• Changed
  • Take care of PackageURL generation ourselves, now
    Previously, this was done at best-effort by a 3rd-party library.
• Dependencies
  • Upgraded runtime-dependency @cyclonedx/cyclonedx-library@^10.0.0 now, was @^9.2.0
  • Added runtime-dependency packageurl-js@^2.0.1
  • Added runtime-dependency spdx-expression-parse@^3.0.1||^4.0.0

Resolves or fixes issue:

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines