feat: Deserializer/Denormalizer

## Context

Currently, we dont have deserializers.
Reason:
- XML: deserializition is complex and potentially insecure
- XML: no (native) deserializer exists
- having JSON deserializers and nothing for XML seams odd
- JSON deserializers require a lot of handcrafting due to the complexity of the spec

With the new CycloneDX 2.0 schemas, we might be able to finally provide proper deserialization.
- XML will be dropped
- JSON is less complex
- we might have the entire spec as models - https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1417

## Goal

have JSON deserializers available

## Related
- previous ticket: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/86