[TRACKING] Complete support for CycloneDX v1.5

see https://github.com/CycloneDX/specification/releases/tag/1.5

The following items are not currently supported for CycloneDX v1.5 (as of release 6.4.x):

- [x] Missing `lifecycles` on `bom.metadata`
see #698
- [ ] Missing `modelCard` on `Component`
- #912
- [ ] Missing `data` on `Component`
- #913
- [x] Missing `bom-ref` attribute on `OrganizationalContact`
- possible fix: #859
- [x] Missing `bom-ref` attribute on `OrganizationalEntity`
- see #799
- possible fix: #859
- [x] Missing `bom-ref` attribute on `LicenseExpression`
- possible fix: #859
- [ ] Missing `licensing` on `DisjunctiveLicense`
- see #948
- [x] Missing `properties` on `DisjunctiveLicense`
- see #947
- [x] Missing `bom-ref` attribute on `DisjunctiveLicense`
- possible fix: #859
- [x] Missing `identity` on `ComponentEvidence`
- see #810
- see #900
- [x] Missing `occurrences` on `ComponentEvidence`
- see #810
- [x] Missing `callstack` on `ComponentEvidence`
- see #810
- [ ] Missing `trust_zone` in `Service`
- see https://github.com/CycloneDX/cyclonedx-python-lib/pull/980
- [ ] Missing `annotations` on `Bom`
- [ ] Missing `formulation` on `Bom`
- [x] `Bom.metadata.tools` missing support for `components` and `services` along with deprecation of `Tool`
- see #561
- see https://github.com/CycloneDX/cyclonedx-python-lib/issues/597
- to be continued

-----

this library is a community effort.
if you find a feature that you need is missing, feel free to donate/contribute the missing feature.
- see #633

Review the CycloneDX v1.5 release and the unresolved checklist entries, especially the linked issues #912, #913, and #948 and the referenced pull request for Service trust zones. This is a tracking issue rather than a focused code task; done means the remaining v1.5 items are implemented and their checklist entries can be marked complete.

Written by the indexing model from the issue text.