transformer: include CPE fields from meta, including possibleCPEs as evidence

[0xf09f95b4]

This PR implements the inclusion of "CPE" fields in current nixos unstable based on #150.

The CPE fields were implemented by adding an identifier field in the meta field of derivations. This field can include cpe as a "definitive" CPE identifier, as well as possibleCPEs as a list of possibly fitting CPE identifiers.

This PR implements the following:

• Update dependencies, especially nixpkgs-unstable.
• Adds Identifiers, CPE as structs to deserialize the identifiers field.
• If cpe exists, add cpe to the SBOM component. Only one CPE is allowed here in the CycloneDX spec.
• If only possibleCPEs exist, add an evidence field to the SBOM, with an entry for each possible CPE. Each entry get's a proportional "Confidence" score, based on the number of possibleCPEs in the metadata.

We could make using "evidence" optional.

In an SBOM this would look like:

With a definitive CPE field:

      "cpe": "cpe:2.3:a:nikstur:bombon-transformer:0.3:0:*:*:*:*:*:*",

While with evidence:

      "evidence": {
        "identity": {
          "field": "cpe",
          "methods": [
            {
              "technique": "other",
              "confidence": 0.5,
              "value": "cpe:2.3:a:gnu:gcc:14.3.0:*:*:*:*:*:*:*"
            },
            {
              "technique": "other",
              "confidence": 0.5,
              "value": "cpe:2.3:a:gnu:gcc:14.3:0:*:*:*:*:*:*"
            }
          ]
        }
      }

[0xf09f95b4]

The failed pipeline was probably caused by the nixpkgs update. That update seems to have changed some stuff about nixfmt, cargo etc., leading to broken checks.

Should probably be fixed in a separate PR.

[nikstur]

@0xf09f95b4 since you allowed maintainers the freedom to edit the changes I took the freedom to do so:

• Applied fixes suggested by me
• Fixed clippy pendatic lints

[nikstur]

Thank you this is very nice! I wouldn't have thought of including the possibleCPEs as evidence but I think this is great.