`cyclonedx-bom` is unsuitable for `cargo auditable` use case

There are several issues that are interfering with using `cyclonedx-bom` to write CycloneDX in `cargo auditable`

`cargo auditable` operates under very different constraints to regular SBOMs; this is what drove me to use a custom format as opposed to using an off-the-shelf CycloneDX or SPDX. The issues currently affecting it are:

- [ ] Toplevel `version` has been made a required field in #618 and is always written. It needs to be omitted to save bytes.
- [x] Toplevel `serialNumber` is always written, even if set to `None`. It needs to be omitted to save bytes.
- [x] [`dependencies.dependsOn`](https://cyclonedx.org/docs/1.5/json/#dependencies_items_dependsOn) is always written, even if empty. It should be omitted when empty to save bytes.
- [ ] There is no way to write a minified JSON. `output_as_json_v1_3` and `output_as_json_v1_4` pretty-print the JSON, wasting space. The `spec` module required to implement it outside `cyclonedx-bom` is private.

Start by reading the output_as_json_v1_3 and output_as_json_v1_4 entry points and the private spec module mentioned in the issue. Check how the top-level version and dependencies.dependsOn fields are serialized, then determine how JSON output can be minified. Done means the requested fields are omitted when appropriate and callers can produce minified JSON for cargo auditable use.

Written by the indexing model from the issue text.