Validate uploaded BOMs against CycloneDX schema

[nscuro]

Description

Adds validation of uploaded BOMs against the CycloneDX schema.

Automatically detects the format and spec version of the uploaded BOM, and picks a matching schema to validate against.

Validation is enabled per default, for both BOMs and VEXs.

Users who find their uploads being rejected unexpectedly can pass the environment variable BOM_VALIDATION_ENABLED=false to disable validation. Because Dependency-Track did not validate BOMs before, it is possible that users are currently uploading invalid files without knowing.

Addressed Issue

Closes #3218

Additional Details

To communicate errors during BOM validation back to clients, responses are returned in RFC 9457 format.

Example:

{
    "status": 400,
    "title": "The uploaded BOM is invalid",
    "detail": "Schema validation failed",
    "errors": [
        "cvc-complex-type.4: Attribute 'tagId' must appear on element 'swid'."
    ]
}

Frontend PR: DependencyTrack/frontend#762

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.15% (target: -1.00%)	✅ 81.94% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (f8a6a0c)	21360	15775	73.85%
Head commit (bd28ebe)	21503 (+143)	15913 (+138)	74.00% (+0.15%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3522)	144	118	81.94%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

_{You may notice some variations in coverage metrics with the latest Coverage engine update. For more details, visit the documentation}