feat: use cyclonedx library ^10.0.0

[jkowalleck]

Description

• Changed
  • Take care of PackageURL generation ourselves, now (via #1416)
    Previously, this was done at best-effort by a 3rd-party library.
• Dependencies
  • Bumped dependency @cyclonedx/cyclonedx-library@^10.0.0 now, was @^8.4.0||^9.0.0 (via #1416)
  • Added dependency packageurl-js@^2.0.1 (via #1416)
  • Added dependency spdx-expression-parse@^3.0.1||^4.0.0 (via #1416)

Resolves or fixes issue:

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ -0.74%	✅ 85.83% (target: 80.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (17fd2c5)	4302	3809	88.54%
Head commit (834c08d)	4680 (+378)	4109 (+300)	87.80% (-0.74%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1416)	247	212	85.83%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences