docs: explain model fixture and snapshot workflow

Description

The contributor documentation links to tests/_data/snapshots/README.md, but that file currently explains only how to regenerate snapshots. It does not explain how BOM model factories in tests/_data/models.py are discovered or how they feed the JSON, XML, and round-trip tests.

This gap came up in the maintainer guidance on #914: https://github.com/CycloneDX/cyclonedx-python-lib/pull/914#issuecomment-3562249425. The maintainer explicitly welcomed a dedicated documentation pull request.

Proposed documentation

Document the existing workflow without changing test behavior:

• get_bom_* factory discovery and snapshot naming;
• _invalid fixtures;
• registration of deliberately incomplete dependency graphs;
• regenerating snapshots, reviewing only the intended files, and rerunning tests with snapshot recreation disabled.

Acceptance

• The documented paths and collector names match the current default branch.
• The shared JSON/XML output and deserialization fixture tests pass.
• The full test suite remains green.

Start with tests/_data/snapshots/README.md and compare its current guidance with tests/_data/models.py and the shared JSON/XML output and deserialization fixture tests. Document the existing factory discovery, snapshot naming, _invalid fixtures, incomplete dependency graphs, and regeneration review workflow; done means the paths and collector names match the default branch and the specified tests and full suite pass with recreation disabled.