syft convert cycloneDx Metadata is lost after reconvert

**What happened**:

regarding #3574 after converting from cycloneDx to syft-json to cycloneDx the metadata object is empty.

**What you expected to happen**:

I would love to keep the metadata somehow

**Steps to reproduce the issue**:

convert the following sbom https://github.com/CycloneDX/bom-examples/blob/master/SBOM/keycloak-10.0.2/bom.json from cdx to syft to cdx and inspect the metadata section

```bash
syft convert bom.json -o syft-json > bom-syft.json
syft convert bom-syft.json -o cyclonedx-json
```

**Anything else we need to know?**:

**Environment**:
- Output of `syft version`:

```
Application: syft
Version: 1.18.1
BuildDate: 2024-12-13T18:41:10Z
GitCommit: 5e16e5031a13f8a11057feb8544decebfc43b4ed
GitDescription: v1.18.1
Platform: darwin/arm64
GoVersion: go1.23.4
Compiler: gc
```

- OS (e.g: `cat /etc/os-release` or similar):

Reproduce the issue with the linked keycloak-10.0.2 bom.json using the two syft convert commands in the report. Compare the input CycloneDX metadata with the metadata after the cdx → syft-json → cdx round trip; done means the metadata is retained in the final CycloneDX output.

Written by the indexing model from the issue text.