Add support for signing and verification

CycloneDX SBOMs can be signed at the root bom level and can also be signed on a component level.

This enhancement request is to add support for applying signatures to the bom level or to a component level. Signing should support [XML Signature](https://www.w3.org/TR/xmldsig-core/) and [JSON Signature Format](https://cyberphone.github.io/doc/security/jsf.html).

When signing a component, it will be necessary to include the `bom-ref` of the component. If a `bom-ref` does not exist or cannot be found for the component, signing should fail.

Signing verification should ideally validate that ALL signatures in the bom regardless of where they're located. This includes the root bom level signatures as well as individual component signatures. All occurrences of failed verification should be logged to to STDERR.

Proposed input parameters:
- Private key (used for signing)
- The filename of the bom to sign or verify (e.g. bom.xml or bom.json)
- The component bom-ref to sign (optional)