Update vulnerabilities to use new Tool specification

[shaikhu]

According to the docs, since v1.5 the Tools format has been deprecated and a new format recommended. While the entity Metada has been updated to use the new format (new method setToolChoice), Vulnerability has not. This PR adds a similar method to Vulnerability.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ -0.02%	✅ 33.33%

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (3702283)	5924	4321	72.94%
Head commit (26896b9)	5927 (+3)	4322 (+1)	72.92% (-0.02%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#438)	3	1	33.33%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

---

_{🚀 Don’t miss a bit, follow what’s new on Codacy.}

_{Codacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more}

[nscuro]

tools should be marked as deprecated to avoid confusion, similar to how it's done in Metadata:

cyclonedx-core-java/src/main/java/org/cyclonedx/model/Metadata.java

Lines 63 to 65 in 3702283

	@VersionFilter(Version.VERSION_12)
	@Deprecated
	private List<Tool> tools;

[shaikhu]

tools should be marked as deprecated to avoid confusion, similar to how it's done in Metadata:

cyclonedx-core-java/src/main/java/org/cyclonedx/model/Metadata.java

Lines 63 to 65 in 3702283

	@VersionFilter(Version.VERSION_12)
	@Deprecated
	private List<Tool> tools;

👍 7fc564a

[nscuro]

Metadata has a custom deserializer to deal with the tool deserialization:

cyclonedx-core-java/src/main/java/org/cyclonedx/util/deserializer/MetadataDeserializer.java

Lines 146 to 167 in 3702283

	private void parseTools(JsonNode toolsNode, Metadata metadata, ObjectMapper mapper) throws JsonProcessingException {
	if (toolsNode.isArray()) {
	setToolInfo(toolsNode, metadata, mapper);
	} else if (toolsNode.has("tool")) {
	JsonNode toolNode = toolsNode.get("tool");
	if (toolNode.isArray()) {
	setToolInfo(toolNode, metadata, mapper);
	} else {
	Tool tool = mapper.convertValue(toolNode, Tool.class);
	metadata.setTools(Collections.singletonList(tool));
	}
	} else {
	ToolInformation toolInformation = new ToolInformation();
	if (toolsNode.has("components")) {
	parseComponents(toolsNode.get("components"), toolInformation, mapper);
	}
	if (toolsNode.has("services")) {
	parseServices(toolsNode.get("services"), toolInformation, mapper);
	}
	metadata.setToolChoice(toolInformation);
	}
	}

That doesn't seem to be the case for Vulnerability. @mr-zepol am I seeing this right that in order to support ToolInformation in Vulnerability, we need a custom deserializer there as well?