Resolve ambiguous definition of `serialNumber`

#### Current Behavior
`serialNumber` is defined as an UUID and RECOMMENDED:
> Every BOM generated SHOULD have a unique serial number, even if the contents of a BOM have not changed over time. If specified, the serial number MUST conform to RFC-4122. Use of serial numbers are RECOMMENDED.

`version` is defined as an integer > 0:
> Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. […]
This contradicts the definition of `serialNumber`, except one interprets these statements, as both fields have to be changed when an extant SBOM is newly generated.

#### Proposed Behavior
In our opinion UUIDs and hence the CycloneDX `serialNumber` must be static ("unequivocal in time and space" = "temporally and spatially unique"), as long as an SBOM creator records the same software component, even if these software componets are altered: e.g. new versions, files or sub-components are added or removed, etc.

Hence, we propose as the definition of `serialNumber`:
*Every BOM creator SHOULD use a unique serial number when describing a specific component, which MUST stay the same if the BOM is re-generated or the contents of this component have changed. If specified, the serial number MUST conform to RFC-4122. Use of serial numbers is RECOMMENDED.*