cyclone-dx: javascript mapping of authors, contributors and maintainers -> component.author

## What would you like to be added:

Update CycloneDX encoder so that people metadata discovered from package.json (and npm registry metadata where available) is emitted under the CycloneDX component.authors array for the affected component(s).

### Specifically:
- Convert each person into a CycloneDX OrganizationalContact object with fields:
name, email, phone will not be present; ignore unknown keys
- Do not use the deprecated component.author (singular) field; only use component.authors (array).
- (optional) set bom-ref if we already assign stable refs for contacts

Note: URL is not part of OrganizationalContact; drop or consider mapping to externalReferences if we choose to extend later

### Why is this needed:

CycloneDX 1.6 models creators of a component via authors (array of OrganizationalContact). Using this provides accurate provenance and aligns with the spec; the legacy author field is deprecated in favor of authors or manufacturer.

URLs present in person strings are currently dropped (no field on OrganizationalContact). If desired later, we could add an externalReferences entry of type website, but that’s out of scope here.

### Acceptance criteria:

For a JS component like
```json
{
"name": "demo",
"version": "1.0.0",
"author": "Alice Doe ",
"contributors": [
{"name":"Bob Roe","email":"bob@example.com"},
"Carol Poe "
],
"maintainers": [
{"name":"Org Maintainer","email":"maint@example.com"}
]
}
```

the CycloneDX output contains:
```json
"components": [
{
"name": "demo",
"version": "1.0.0",
"authors": [
{"name":"Alice Doe","email":"alice@example.com"},
{"name":"Bob Roe","email":"bob@example.com"},
{"name":"Carol Poe","email":"carol@example.org"},
{"name":"Org Maintainer","email":"maint@example.com"}
]
}
]
```

Non-goals (can be separate issues):

- Mapping url to externalReferences
- Inferring or populating manufacturer/supplier
- Backfilling non-JS ecosystems