Custom `MarshalJSON` methods ignore `SetEscapeHTML(false)`: `&` always escaped to `\u0026`

## Description
When encoding a BOM to JSON with **SetEscapeHTML(false)**, the output still escapes `&` to `\u0026` in certain fields. This happens because custom **MarshalJSON()** methods in the library use **json.Marshal()** internally, which always escapes HTML characters regardless of encoder settings.

**For example:** a tool name like "Assembler & Editor" or a PURL like `pkg:pypi/example-lib@1.0.0?file_name=example_lib-1.0.0-py3-none-any.whl&repository_url` will have `&` converted to `\u0026` in the final JSON output, even when the caller explicitly requested no HTML escaping.

Here it is reproduce via sbomqs: https://github.com/interlynk-io/sbomasm/issues/337, as sbomqs internally uses cyclonedx-go library for the same.

## To reproduce

Disable it to `SetEscapeHTML(false)`
```go
var encoder cydx.BOMEncoder
encoder.SetEscapeHTML(false)
```

But inspite of disabling it, even it escape the `&` to `\u0026`.

**Environment:**
- Library: github.com/CycloneDX/cyclonedx-go
- Version: v0.11.0
- Go version: 1.22+

Search the library's custom MarshalJSON methods and start by reproducing the BOM encoding with SetEscapeHTML(false), using the tool name or PURL examples from the issue. Check the resulting JSON for \u0026 and verify that the relevant fields preserve the caller's HTML-escaping setting when the fix is complete.

Written by the indexing model from the issue text.