[v1.1](https://github.com/CycloneDX/cyclonedx-javascript-library/releases/tag/v1.1.0) introduced nested components. unfortunately the serializers do not make nested component's `bom-ref`s unique as expected. this should be fixed.