Low EPSS scores are serialized in E-notation, causing validation to fail

Coming from [here](https://github.com/oss-review-toolkit/ort/issues/9556), it seems that an [EPSS vulnerability score of 0.000760000](https://api.first.org/data/v1/epss?cve=CVE-2020-15250) is serialized as "7.600000244565308E-4" (at least in XML), which causes https://cyclonedx.github.io/cyclonedx-web-tool/validate to fail with

> The 'http://cyclonedx.org/schema/bom/1.5:score' element is invalid - The value '7.600000244565308E-4' is invalid according to its datatype 'http://www.w3.org/2001/XMLSchema:decimal' - The string '7.600000244565308E-4' is not a valid Decimal value.

Maybe a solution would be to force serialization always at some fixed precision. Or validation could be changed to accept E-notations for floating point numbers, but I guess that would be a harder task.