[FEATURE] Ensure bom-ref for Component and Vulnerability have a (unique) value

[madpah]

Currently our models rely on the consumer to specifiy/provide a value for a Component or Vulnerability's bom-ref.

In previous versions of this library, the purl was automatically used for this purpose (for Component) but this was removed as a Component may not have a purl.

As pointed out in sonatype-nexus-community/jake#91, for Vulnerabilities to be able to specify which Components are affected (in 1.4), Components must have a bom-ref - see here.

It's worth noting that bom-ref is optional within the schema for both Component and Vulnerability.

This Feature will look to assign a UUID as the bom-ref if a value has not been provided by the consumer.

[jkowalleck]

some related thoughts: https://github.com/CycloneDX/cyclonedx-php-library/blob/master/docs/dev/decisions/BomDependencyDataModel.md

PHP implementation that assignes bom-refs and makes then unique on render time: https://github.com/CycloneDX/cyclonedx-php-library/blob/master/src/Core/Serialize/BomRefDiscriminator.php
and the unit tests for it: https://github.com/CycloneDX/cyclonedx-php-library/blob/52a8e7e642480429249f5ff3cd5944b80451e98b/tests/Core/Serialize/BaseSerializerTest.php#L113

[damiencarol]

@madpah can't we use PURL string as the bom-ref for component? the specification do that in the examples.
Could be better than generate a UUID and keep a trace of it, etc...
see https://github.com/CycloneDX/specification/blob/master/tools/src/test/resources/1.4/valid-vulnerability-1.4.json

[madpah]

@madpah can't we use PURL string as the bom-ref for component? the specification do that in the examples. Could be better than generate a UUID and keep a trace of it, etc... see https://github.com/CycloneDX/specification/blob/master/tools/src/test/resources/1.4/valid-vulnerability-1.4.json

@damiencarol - we can't use a PURL in most circumstances, but the model provided for by this library allows that to be the case. This PR was a precursor to a full fix in jake btw.

[damiencarol]

will test it as soon as it's ready.
FYI: I'm working on making Jake importing works for https://github.com/DefectDojo/django-DefectDojo