Invalid ExternalReference URLs in Generated CycloneDX SBOMs

Hi,

we are encountering issues with some generated CycloneDX SBOMs because they contain invalid ExternalReference URLs.

According to the official [CycloneDx JSON schema](https://github.com/CycloneDX/specification/blob/22fb0c2fe5fb0976b9ef5d1aef01cbc46c39a483/schema/bom-1.6.schema.json#L1715) the `ExternalReference.url` must be of format `iri-reference`.

However, when generating an SBOM for Maven projects, we receive ExternalReference URLs that appear as Maven SCM coordinates, which do not conform to the iri-reference format.

See an example below:

```

scm:git:git@github.com:tomitribe/http-signatures-java.git

```

Start by reproducing the Maven-project SBOM generation described in the issue and trace how the project's SCM coordinate becomes an ExternalReference URL. Compare the generated reference with the CycloneDX JSON schema's iri-reference requirement; done means the generated VCS reference uses a valid URL format.

Written by the indexing model from the issue text.