Enable ORT to generate CycloneDX 1.6 SBOMs

[tsteenbe]

Enabling generation of CycloneDX 1.6 SBOMs will be useful for license compliance as 1.6 supports both concluded and declared licenses. We should make a decision on which SBOM spec version we going to support - ideally develop a option for users to able to select a specific spec version such as CycloneDX [1.4, 1.5 or 1.6] or SPDX [2.2, 2.3 or 3.0]

See also
CycloneDX/specification#407
https://github.com/CycloneDX/specification/blob/1.6-dev/schema/bom-1.6.proto
https://github.com/CycloneDX/specification/blob/1.6-dev/schema/bom-1.6.schema.json
https://github.com/CycloneDX/specification/blob/1.6-dev/schema/bom-1.6.xsd

[sschuberth]

This is blocked by CycloneDX/cyclonedx-core-java#392.

Edit: Now blocked by CycloneDX/cyclonedx-core-java#408 and CycloneDX/cyclonedx-core-java#409.