Clarify and align supported CycloneDX versions in the AboutCode stack

[pombredanne]

We should have a consistent support for versions we can import and export and this may not be consistent?
My take is that this should support:

• 1.5 for the output format across all tools
• 1.4 and up (or 1.3 and up) as the input format for all tools

We should also ensure that we update all tools at once.

• SCIO https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/cyclonedx.py 1.4? 1.5?
• SCTK https://github.com/nexB/scancode-toolkit/blob/develop/src/formattedcode/output_cyclonedx.py 1.3?
• DJCD https://github.com/nexB/dejacode/blob/badc0d68ec5e6535069c003e10676d230da8560d/dje/views.py#L2343 ?

I am filing this issue here and we may need to break this down as needed in each repo.

[pombredanne]

For compat, it may be useful to support reporting CycloneDX 1.4 AND 1.5

[tdruez]

ScanCode.io:

• input: 1.2 to 1.6, JSON and XML https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/cyclonedx.py
• output: 1.4 to 1.6 JSON https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/output.py#L715

DejaCode:

• input: 1.2 to 1.6, JSON and XML (delegated to ScanCode.io)
• output: 1.4 to 1.6 JSON

[tdruez]

Moved to scancode-toolkit repo for action to update the CycloneDX support.

[pombredanne]

See also:

• Improve --cyclonedx output option #2987