feat: include `component.evidence.identity` in the SBOM

## Is your feature request related to a problem? Please describe.

Establishing accurate component identity is important in an SBOM, as it enables users to clearly understand how each component's identity was determined and the methods applied in this process.

## Describe the solution you'd like

By including Component's `.evidence.identity` within the SBOM, we provide transparency on the techniques and data sources used to verify component identity, enhancing both the reliability and trustworthiness of the SBOM.

https://cyclonedx.org/docs/1.6/json/#components_items_evidence_identity

The issue names no implementation files or tests. Start by tracing where components are serialized into the SBOM, then compare the output with the linked CycloneDX 1.6 definition for components.evidence.identity. Done means generated SBOM output includes the requested identity evidence.

Written by the indexing model from the issue text.