add support for CDX "vulnerability" features

* XML schema: https://github.com/CycloneDX/specification/blob/master/schema/ext/vulnerability-1.0.xsd
* docs: https://cyclonedx.org/ext/vulnerability/
* example: https://cyclonedx.org/use-cases/#vulnerability-disclosure

:hand: issue: there is no JSON port for this extension - see https://github.com/CycloneDX/specification/issues/37
:construction: unless we have a valid json schema for it, it is impossible to properly implement for all SBoM results

caused-by: https://github.com/CycloneDX/cyclonedx-php-composer/issues/142

Start with the linked CycloneDX vulnerability XML schema, documentation, and vulnerability-disclosure example, then review specification issue 37 for the missing JSON counterpart. The work is complete only when a valid JSON schema exists and the library can support the vulnerability extension for all SBOM results.

Written by the indexing model from the issue text.