Need to refine and report CycloneDX SBOM metadata

For a CycloneDX SBOM (v1.4 to v1.6) you can report a component in the "metadata" section (header) in addition to the "components" section (details). This component represents "The component that the BOM describes". It has the same attributes (including PURL) as a component in the body of the SBOM. This top-level component might be a container (pkd:oci) or other software package.

We need to:
1. Capture this metadata/component (header) data separately from the components (details) data and
2. Capture and report other CycloneDX header information such as:
- bomFormat
- specVersion
- metadata/authors
- metadata/properties
- metadata/timestamp
- metadata/tools

Unfortunately the data elements of an SPDX v2.3 Document are very different and I cannot figure out the analogy for SPDX 3.0. We probably need some CDX-specific data structure or possibly we just capture this as some blob of data with key-value pairs.