`organizationalContact` enhancements

Consider enhancing `organizationalContact` to support the following:

- public gpg key bom-ref - This is especially useful to verify publishers and identify all components published with the same key. Tools must first create a component of type `cryptographic-asset` and use that bom-ref in the contact attribute
- tags - Tags such as `maintainer` or git user ids can help locate the contact and their published components faster