Add better defintion for hashes

CycloneDX is great format and can be used for multiple purposes - thank you!

CycloneDX allows to specify hashes, for integrity, for packaging, etc.
You can specify the hash algorithm and the hash value.

What I am missing is for **what** the hash has been calculated, i.e. for which file.
Imagine there is NuGet component- is the has for the Nuget package (system.buffers.4.5.1.nupkg)
or for the library itself (System.Buffers.dll)?
A similar question pops up when we want to add the hash of the tool that has been used to
create the SBOM . is it the executable, the setup or the zip-file?

=> Wouldn't it be more suitable to add a `file` property to the hash?