Devguard does not support SBOM without BomRef

Describe the bug
A Bom without a BomRef can't be uploaded.

Related to: https://github.com/l3montree-dev/devguard/blame/a0c53007f799226a5e9f4062ffdf2f459f22b0f4/normalize/sbom_graph.go#L1516

Expected behavior
Devguard does not require an optional field within the SBOM spec to be mandatory / required.

https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_bom-ref

Additional context
JFrog's XRay / Artifactory creates SBOMs with a BomRef on the root component.

{
  "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:b1e4c3c3-4203-4b06-b43e-5417a687ae60",
  "version": 1,
  "metadata": {
    "timestamp": "2026-08-25T10:13:57+02:00",
    "tools": [
      {
        "vendor": "JFrog Inc.",
        "name": "Xray",
        "version": "3.150.28"
      }
    ],
    "component": {
// here no bom-ref :( 
      "type": "application",
      "name": "lorem-ipsum.zip",
      "purl": "pkg:generic/lorem-ipsum.zip"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:generic/lorem-ipsum.zip",
      "type": "application",
      "name": "lorem-ipsum.zip",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "737e5670107c2ba34e91c62ee7a8bac6142b212dd1029b34f74218120d9a26b2"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "GPL-2.0-only",
            "url": "http://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html"
          }
        },
        {
          "license": {
            "name": "LicenseRef-jfrog-oracle-openjdk-exception-2.0"
          }
        }
      ],
      "purl": "pkg:generic/lorem-ipsum.zip"
    }
......

Start in normalize/sbom_graph.go around line 1516 and reproduce the upload with the CycloneDX 1.7 JSON example, where metadata.component lacks bom-ref. Trace why that optional field is treated as required, then verify that the sample SBOM uploads successfully without requiring metadata.component.bom-ref.