chore(cyclonedx): metadata.tools uses the shape deprecated in 1.6

[sonukapoor]

Follow-up from the review of #1093, filed so it is not lost.

Problem

src/output/cyclonedx.ts emits metadata.tools in the legacy array form:

tools: [{ vendor: "OWASP", name: "CVE Lite CLI", version }]

The CycloneDX 1.6 schema marks this shape as deprecated: "[Deprecated] This will be removed in a future version. Use component or service instead."

It still validates today, because 1.6's tools property is a oneOf that accepts both the legacy array and the modern object. So this is not urgent and nothing is broken. But it is the one place where 1.4 to 1.6 genuinely did change structure, and it is what will break when we move to 1.7.

The modern shape

Verified valid against the real 1.6 schema:

"tools": {
  "components": [
    {
      "type": "application",
      "name": "CVE Lite CLI",
      "version": "1.33.0",
      "publisher": "OWASP"
    }
  ]
}

Note publisher replaces vendor, which does not exist on a component.

What to do

Change the CycloneDxMetadata type and the construction in buildCycloneDxBom to emit the tools.components form, and update tests/cyclonedx.test.ts to pin it.

Worth checking before committing: some consumers still expect the legacy array. Dependency-Track is the main one to verify, since it is the integration our docs point people at. If it turns out to need the old shape, close this and record why, rather than shipping output a documented consumer cannot read.

Verifying

Do not add a schema-validation dependency to the project. Validate out-of-tree, for example by installing ajv in a scratch directory and checking the emitted BOM against https://raw.githubusercontent.com/CycloneDX/specification/master/schema/bom-1.6.schema.json (it references jsf-0.82.schema.json and spdx.schema.json from the same directory, which need loading too).

Notes

Blocks a future move to CycloneDX 1.7, where the legacy form is expected to be removed rather than merely deprecated.