[FEATURE]: EPSS Score on Vulnerability model

## Describe the feature

Vulnerabilities can have an [EPSS](https://www.first.org/epss/) score attached to them. This describes the probability of a vulnerability being exploited. As of spec version 1.6, there is no clear way to attach this to a CycloneDX Vulnerability.

A vulnerability does have a slot for [`ratings`](https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_ratings), but it is not clear whether it can be used to include the EPSS, which consists of two values (the probability score itself, a percentile). It might be worth introducing a new slot for this vulnerability attribute.

## Possible solutions

Shooting from the hip.

```
type Vulnerability {
bom-ref string
// ...
epss EpssScore
}

type EpssScore {
probability float
percentile float
}
```

## Alternatives

Getting it into the `ratings`, but it does not really fit the "severity" category that `ratings` was intended for.

## Additional context

Support for EPSS was added to SPDX 3.0: https://spdx.github.io/spdx-spec/v3.0/model/Security/Classes/EpssVulnAssessmentRelationship/