Compatibility with CycloneDX 1.6

[berndorin]

Greetings,
After changing from CycloneDX 1.5 to CycloneDX 1.6, osv-scanner seems not to be compatible with CycloneDX 1.6.
By scanning the SBOM-File we are getting the following output

Failed to parse SBOM using all supported formats:
failed to parse SPDX:
failed trying json: JSON document does not contain spdxVersion field
failed trying rdf: found stray characters at EOF
failed trying tv: no colon found in '{'
failed to parse CycloneDX:
failed trying json: invalid specification version
failed trying xml: EOF

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.

[oliverchang]

@another-rex is this addressed by OSV-Scalibr?