[TRACKING] Complete support for CycloneDX v1.7

see https://github.com/CycloneDX/specification/releases/tag/1.7

The following items are not currently supported for CycloneDX v1.7 (as of release 11.4.x):

- [ ] external components
- see https://github.com/CycloneDX/cyclonedx-python-lib/pull/959
- [ ] version ranges on components
- requires feature "external components"
- [ ] multiple SPDX License Expressions alongside with other licenses
- [ ] license expression details and properties
- [x] expressing BOM distribution constraints with the Traffic Light Protocol (TLP) in metadata
- via #906
- [ ] representing patent information
- [x] properties on external-references
- via #907
- [ ] citations
- [ ] detailing cryptographic transparency information
- to be continued

----

this library is a community effort.
if you find a feature that you need is missing, feel free to donate/contribute the missing feature.

- see https://github.com/CycloneDX/cyclonedx-python-lib/issues/633

Start by reading the CycloneDX v1.7 release notes and the unchecked items in this tracking issue. Review the linked external-components work in pull request #959 and the completed related issues #906 and #907 to understand the project’s approach. Done requires implementing and testing the remaining v1.7 capabilities, including external components, licenses, patents, citations, and cryptographic transparency information.

Written by the indexing model from the issue text.