Expose spec in cyclonedx-bom

I'm needing to serialize & deserialize things because the `cached` crate uses serde. I am using `cached` so I can increase performance of some heavy SBOM generation by leveraging caching. There's 2 options which I can see be done. One is make everything in `cyclonedx-bom/src/specs` become public outside of the crate. The other is to make everything have the `serde::Serialize` and `serde::Deserialize` traits. Either option would work but I'd prefer the latter so I don't have to convert between things. If there's another option, I'm all ears but I'm wondering what's the best solution here.

Start by inspecting cyclonedx-bom/src/specs and the crate's current public API. Compare exposing those types with adding serde::Serialize and serde::Deserialize support, then check how the cached crate would use the result. Done means external callers can serialize and deserialize the relevant SBOM types without conversion.

Written by the indexing model from the issue text.