Custom validation applies components requirements to tools

[mmarseu]

This is a side-effect of the change to the tools field in CDX 1.5.
When tools is an object, it can contain two arrays: components and services. The official schema applies the regular schemas for those two types to the arrays, which makes sense for them.

In our custom schema that means that all requirements meant for components automatically also apply to tools - for example, bom-ref, copyright, license, etc. This is arguably nonsense and should be changed.

[italvi]

Would expect that something like that is covered by our tests 😅

[CBeck-96]

The tests only cover fields contained in our CB specification, tools is not among them.