since CycloneDX v1.3 the external references are able to keep hashes.

see JSON: https://cyclonedx.org/docs/1.5/json/#externalReferences_items_hashes
see XML: https://cyclonedx.org/docs/1.5/xml/#type_externalReference

request:

1. add the hashes to the models.
2. add them to normalizers & serializers