Disable HTML escaping when output in JSON

cyclonedx-gomod output SBOM with HTML escaped when --json flag was specified.
This converts `&` in purl to `\u0026` which sometimes is not parsed correctly in other tools.

We can find an example at
https://github.com/CycloneDX/cyclonedx-gomod/blob/e54760d8f6a1252608b24476c41d5e8e7ac6cb45/examples/app_minikube-v1.23.1.bom.json#L53

Proposal:

- DIsable HTML escape globally
or
- Add CLI option to disable HTML escaping

Because the [BOMEncoder in cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go/blob/master/encode.go#L27-L41) already has the method `SetEscapeHTML(escapeHTML bool)`, changes should be necessary only around here.
https://github.com/CycloneDX/cyclonedx-gomod/blob/e54760d8f6a1252608b24476c41d5e8e7ac6cb45/internal/cli/util/util.go#L98-L99

Start in internal/cli/util/util.go at the JSON output path referenced by the issue, then read BOMEncoder.SetEscapeHTML in cyclonedx-go's encode.go. Use the --json entry point and the example BOM to verify that purl ampersands are emitted without HTML escaping, while the JSON remains valid.

Written by the indexing model from the issue text.