Add configurable XML parser maxDepth support

Please add support for a configurable XML parser nesting-depth limit, for
example `maxDepth`, when parsing CycloneDX XML BOMs.

Motivation: CycloneDX XML allows nested structures such as
`component/components/component`. Consumers that parse third-party or automated
SBOM XML would benefit from an explicit depth boundary so unusually deep
documents fail with a controlled parse error instead of relying on process
stack limits.

Suggested behavior:

- Add a configurable XML nesting-depth limit for recursive model parsing
- Use, for instance, `32` as the default limit
- Return a structured XML parse error when the limit is exceeded
- Preserve existing behavior for ordinary low-depth BOMs

The default should be high enough for normal CycloneDX documents while bounding
pathological nesting. Consumers with unusual legitimate deeper documents could
opt in by raising the configured limit.

Locate the XML BOM parsing entry points and existing parse-error tests in the repository, then trace how recursive model parsing handles nested components. Define how the configurable limit is passed and how an exceeded limit is represented as a structured parse error. Done means the default bound is enforced, deeper limits can be configured, ordinary low-depth BOMs retain their behavior, and tests cover both paths.

Written by the indexing model from the issue text.