Description of `metadata.supplier` is confusing

As of v1.5, the description of `metadata.supplier` states:

https://github.com/CycloneDX/specification/blob/299209abd9531d808e0cc4235e77a7c4b1b53d96/schema/bom-1.5.schema.json#L268-L271

This is in addition to `metadata.component.supplier`, which states:

https://github.com/CycloneDX/specification/blob/299209abd9531d808e0cc4235e77a7c4b1b53d96/schema/bom-1.5.schema.json#L430-L434

Based on those descriptions, it is unclear what the subject of `metadata.supplier` is. `metadata.component` *is* the component that the BOM describes, meaning `metadata.component.supplier` would be the same as `metadata.supplier`.

As discussed in [this Slack thread](https://cyclonedx.slack.com/archives/CVA0G10FN/p1699447821448959), it seems that `metadata.supplier` describes the supplier **of the BOM itself**. If that is the case, the schema documentation should be updated to include this fact.