CycloneDX 1.6 was released: https://github.com/CycloneDX/specification/releases/tag/1.6

lets add minimal support for it:

• all existing enums should support the new cases from CDX 1.6
• normalize/serialize to valid CDX 1.6 in XML
• normalize/serialize to valid CDX 1.6 in JSON
• when normalizing: some existing enums might use fallbacks in older CDX versions
• add validation against schema 1.6 JSON
• add validation against schema 1.6 XML
• have upated list of SPDX licenses that are supported by CDX