Add support for properties

Is your feature request related to a problem? Please describe.

I do have issues, but they're very specific to me. More broadly my problem is just how can I add arbitrary data to further describe my component in the SBOMs?

Things like somewhere to put a URL to a build server (although the standard has a specific spot for this), a commit hash, an EOS/EOL date, the dependency scopes included in this SBOM, or any other wild and wonderful things people might find they want/need in their SBOMs.

Describe the solution you'd like

As of 1.3, the CycloneDX format supports a properties array in any component, including the metadata's component. I'd love the ability to just specify a map as a task input which gets used as the metadata component's properties.

That should let anybody do something simple like this:

tasks.cyclonedxBom {
  properties = ["foo": "bar"]
}

or more complicated stuff that takes outputs from other tasks and uses them instead in addition to a static collection.

Describe alternatives you've considered

No response

Additional context

There's a similar issue open with the Maven plugin, https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/131.

Implementing this for Gradle seems much easier however.

Contribution

• I am willing to provide an implementation
• I will wait until somebody else implements it

Start from the tasks.cyclonedxBom Gradle task input described in the issue and trace how the metadata component is serialized into the CycloneDX SBOM. Confirm that a supplied properties map appears in the metadata component's properties array, including values produced by other task outputs.