XmlParser - unable to parse XML SBOM with evidence entries

XmlParser - unable to parse XML SBOM with evidence entries

Parsing fails with
```
[ERROR] CycloneIT.test:15->parseSbomXml:21 » Parse com.fasterxml.jackson.databind.exc.MismatchedInputException:
Cannot deserialize value of type `java.util.ArrayList`
from Object value (token `JsonToken.START_OBJECT`)
at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: org.cyclonedx.model.Bom["metadata"]->
org.cyclonedx.model.Component["evidence"]->org.cyclonedx.model.Evidence["occurrences"])
```

Reproducer:
* download [code-with-quarkus-cyclonedx-xml.zip](https://github.com/user-attachments/files/32186918/code-with-quarkus-cyclonedx-xml.zip)
* run `mvn clean verify`

Code is just:
```java
@Test
void test() throws Exception {
Bom bom = parseSbomXml(new File("."), "quarkus-run-cyclonedx.xml");
}

static Bom parseSbomXml(File testDir, String sbomFileName) throws Exception {
File sbomFile = new File(testDir, "target/" + sbomFileName);
assertTrue(sbomFile.exists());
return new XmlParser().parse(sbomFile);
}
```

SBOM XML is generated by Quarkus cyclonedx extension (https://quarkus.io/guides/cyclonedx/) during build phase. cc @aloubyansky

Start with XmlParser.parse and reproduce the failure using the supplied Quarkus SBOM and the test's parseSbomXml entry point. Inspect how evidence.occurrences is read when it contains an XML object, then run mvn clean verify; done means the XML SBOM parses without the MismatchedInputException.

Written by the indexing model from the issue text.