fix(output): bump default CycloneDX output to 1.6 - #1093

The core of this is right and I verified it properly: I generated real BOMs from the built CLI and validated them against the actual CycloneDX 1.6 schema. --cdx, --sbom cyclonedx and --sbom-inventory-only all produce valid 1.6. Your claim that the existing shape needed no structural changes holds up.

Three things I particularly liked. You respected both prohibitions in the issue, no schema-validation dependency and no version-qualified aliases, and I checked that package.json and SBOM_FORMAT_ALIASES are untouched. You listed CVSSv4 and SSVC in the scoreMethod test, which are 1.6 additions absent from 1.4, so you clearly read the schema diff rather than doing a find and replace. And you correctly left CHANGELOG.md alone and flagged the behaviour change in the description instead. That last one is maintainer-managed here and contributors usually get it wrong in the other direction.

Two things before this can go in.

It needs a rebase. #1095 merged this morning and restructured src/output/cyclonedx.ts. The good news is that file auto-merges cleanly; only src/cli/help.ts conflicts. Resolve it by keeping main's new --sbom and --cdx lines and changing cyclonedx (1.4) to cyclonedx (1.6) there.

Six places still advertise 1.4, so after this the tool would emit 1.6 while its own docs say otherwise:

action.yml:63                    website/docs/cyclonedx.md:7
website/docs/cli-reference.md:41 website/docs/github-action.md:41
README.md:369                    website/docs/spdx.md:22

action.yml is the one I care most about, since that description is what every Action user reads.

Two small things: the trailing newlines were stripped from src/cli/help.ts and tests/cyclonedx.test.ts, and three of the four new tests pass unchanged at 1.4, so they are not actually pinning 1.6. The instinct to assert the schema's required fields was right, those particular fields just did not change between versions.

Also, the pre-existing test failures you mentioned do not reproduce here. Full suite is green on your branch and rebased on main, so nothing is broken upstream.

All four addressed, and the help.ts conflict was resolved exactly right: main's --sbom, --sbom-inventory-only and --cdx lines are all intact with just the version bumped. No stale references left anywhere.

I also re-ran the checks properly rather than just confirming the asks. The emitted BOM validates against the real 1.6 schema, and reverting the version now fails 5 of 15 tests where it previously failed 2. You went past what I asked for and fixed the weak-assertion problem I had only mentioned in passing.

Verified on your branch: 1756 tests pass, build clean, real scan emits specVersion: 1.6.

Good first contribution. You respected both prohibitions in the issue without being reminded, read the actual schema diff rather than find-and-replacing, and handled the CHANGELOG correctly by flagging the behaviour change instead of editing a maintainer-managed file. I will add the release-note line at merge.