Export project tags in project inventory export

### Current Behavior

CycloneDX spec v1.6 [added support for component Tags](https://github.com/CycloneDX/specification/releases/tag/1.6), but it's currently missing on the api side when exporting a project's bom passing version=1.6

### Proposed Behavior

It would be useful to add the project's tags into the exported bom's metadata, the data structure is already there on the cyclonedx side, as seen below:

```

2026-07-02T09:41:08Z


OWASP
Dependency-Track
4.14.3-SNAPSHOT



test

abcde



```

To be clear: the UI, at least for 4.x, defaults to 1.5 when requiring an inventory export, and that's fine. As a first step I think it would be enough to make this available on the api side, when calling the endpoint specifying a version:
```
GET /api/v1/bom/cyclonedx/project/5845f052-fe3f-48bc-bdb8-c3ff732397af?format=XML&variant=withVulnerabilities&download=true&version=1.6
```
I've got some patch working locally, I could contribute a PR if you deem this reasonable, but I'd need some time to go through the contributor guidelines.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Start at the project CycloneDX BOM endpoint shown in the issue and trace the version=1.6 export path. Use the provided XML shape and an API request with version=1.6 to verify that the project's tags appear in the exported component metadata; done means the tags are present without changing the default 1.5 behavior.

Written by the indexing model from the issue text.