Allow selecting older CycloneDX spec versions when generating BOMs

[ch8matt]

Description

Trivy currently appears to generate CycloneDX SBOMs using the latest CycloneDX spec version supported by its CycloneDX dependency.

FYI, the cyclonedx-go library Trivy uses supports encoding to a specific version via EncodeVersion:

https://pkg.go.dev/github.com/CycloneDX/cyclonedx-go#BOMEncoder

Would you consider exposing an option to choose the CycloneDX spec version for generated BOMs, for example to generate BOMs using a lower-than-latest spec version?

This would be useful for compatibility with tools that do not yet support the newest CycloneDX spec like DependencyTrack/dependency-track#5818

Target

None

Scanner

None