[2.0] spec review: must --> shall

THe CycloneDX 2.0 schema will be transferred into Ecma-242, 3rd edition.

Per Ecma guidelines, the word "must" should not be used, instead the word "shall" should be used. - as mentioned by @gesa .
(except when it comes to legal stuff - as mentioned by @mjherzog)

- we need to review the textual part of the schema 2.0 to not use "must", but use "shall".
- are there other such phrasing rules?

I think we have a linter tool that could find all "must".