BomUploadProcessingTask: Failed to parse BOM; JsonMappingException: Cannot deserialize value of type ArrayList<Component> from Object

### Current Behavior

When uploading a Cyclone DX file (v1.3 schema) file generated for a Rust project by `cargo-cyclonedx cyclonedx`, an error is logged by Dependency-Track:

```
2025-07-10 03:55:36,793 ERROR [BomUploadProcessingTask] Failed to parse BOM [bomUploadToken=f3a5b3e4-b40f-4a09-83dc-86e66b1a8a2e, projectName=clap, projectUuid=2e2bbab1-2f5b-408c-b55e-7f4ae59a74a5, projectVersion=4.5.41]
org.cyclonedx.exception.ParseException: com.fasterxml.jackson.databind.JsonMappingException: Cannot deserialize value of type `java.util.ArrayList` from Object value (token `JsonToken.START_OBJECT`)
at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: org.cyclonedx.model.Component["components"]) (through reference chain: org.cyclonedx.model.Bom["metadata"])
at org.cyclonedx.parsers.XmlParser.parse(XmlParser.java:101)
at org.dependencytrack.tasks.BomUploadProcessingTask.processEvent(BomUploadProcessingTask.java:161)
at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:153)
```

Relevant log snipped showing the full exception trace is here: [log.txt](https://github.com/user-attachments/files/21173558/log.txt)

The CDX file is attached here (I changed the extension to .xml.txt so that I could upload it to github): [clap.cdx.xml.txt](https://github.com/user-attachments/files/21173562/clap.cdx.xml.txt)

I have run `cyclonedx validate` against it, and it returns that it is valid.

No evidence of the failed parsing is shown in the UI, making it unclear if the issue was a failure if the analysis is taking a long time. (It's almost like the halting problem from the perspective of the end user who doesn't have access to the logs.) ;)

### Steps to Reproduce

1. Log into the Dependency-Track UI, click on "Projects", then click on the project name to open the project page.
2. Click on "Components" tab.
3. Click on the "Upload BOM" button and upload the CDX file attached to this issue.

### Expected Behavior

1. If an error occurs during parsing, some evidence in the UI should exist to show that something went wrong.
2. An error should not be thrown during the parsing of the attached CDX file.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17.5

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported