Added identity and occurrences to evidence. Updated test cases.

[stevespringett]

Closes #129

[stevespringett]

I'm not sold on the idea that this "field" needs to even be there. The original idea was to be able to separate out individual evidence of group/name/version into individual pieces of evidence. But for some things, it actually doesn't make sense (like purl).

[stevespringett]

Same would apply fo "field" in the XML and protobuf.

[jkowalleck]

👍 this is in line with #198

[jkowalleck]

according to

specification/schema/bom-1.5.schema.json

Lines 1262 to 1268 in 56dfd3d

	"confidence": {
	"type": "number",
	"minimum": 0,
	"maximum": 1,
	"title": "Confidence",
	"description": "The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence."
	},

and

specification/schema/bom-1.5.schema.json

Lines 1299 to 1305 in 56dfd3d

	"confidence": {
	"type": "number",
	"minimum": 0,
	"maximum": 1,
	"title": "Confidence",
	"description": "The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence."
	},

We have an overall confidence, and we have multiple specific confidence values.
One could argue that an overall confidence might be derived of (e.g. meridian over all) all specific confidences. This would be true if all specifics were weighted equally.
The mere existence of an overall confidence value indicates that this is not the case.

Therefore, i would argue, that the weighing of each specific confidence value should be published.
And if this was published, then an overall value would no longer make sense, since it could be calculated by each tool that digested this document.

❌ Therefore, Ii do not agree to the existence of such property.

---

PS: here are examples:

weights unknown

specific confidence A: 0.5 
specific confidence B: 0.75
specific confidence C: 1.0
overall confidence: 0.8  << how? what weighting was used to justify this value? has no value to me, as details are missing

weights are equal - per definition

specific confidence A: 0.5
specific confidence B: 0.75
specific confidence C: 1.0
overall confidence: 0.75  <<  has no value to me, as i could calculate it myself: (0.5 + 0.75 + 1.0) / 3

individual weights published

specific confidence A: 0.5 (at weight 0.1)
specific confidence B: 0.75 (at weight 0.2)
specific confidence C: 1.0 (at weight 1.0)
overall confidence: 0.4  <<  has no value to me, as i could calculate it myself: ((0.5* 0.1) + (0.75 * 0.2) + (1.0 * 1.0)) / 3

[stevespringett]

@jkowalleck Thanks for your input. Based on today's IWG meeting, it's my understanding that weight is no longer being considered, as its up to the consumer to place weight on what they believe are the most important techniques for analysis. Is that correct? Is weight being withdrawn? If so, then perhaps some documentation improvements to describe consumer weighting?

[stevespringett]

Per #129 (comment) callstack is being added in. Will update when complete.

[stevespringett]

Ok, callstack support has been added back into this PR and test cases