feat: detail runtime dependencies

## Is your feature request related to a problem? Please describe.

i am detailing my runtime to`node` via `package.json::engines` - see
```json
{
"engines": {
"node": ">=0.10.3 <15"
}
}
```

I want this information being detailed in the SBOM generated by this very tool.

## Describe the solution you'd like

the sourced information may stem from package manifest (`package.json`) or from lockfile or from `npm-ls`

* populate `$.metadata.component.properties` with `cdx:npm:package:constraint:engine: = ` being whatever value found in the package manifest. as per
* optional, for known JS runtimes: for CycloneDX 1.7 add a component to the components list, that has the following attributes:
* type: `platform`
* group: empty
* name: `node`, or `deno` or whatever it is ...
* version: unset
* versionRange: a VERS value `vers:npm/...` - see https://github.com/package-url/vers-spec/blob/main/VERSION-RANGE-SPEC.md
* isExternal: `true`
* packageUrl: empty, as
* have this new component a dependency of `$metadata.component`

## Describe alternatives you've considered

none

## Additional context

docs:
- packageJSON "engines":
- CDX properties taxonomy `cdx:npm:`
- CDX "isExternal" feature:
- CDX "versionRange" feature:
- VERS spec:

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it