Omit null CycloneDX component fields #5355

[0Cymantek0]

Fixes #5355

CycloneDxComponent.to_dict() always emitted the optional component keys, so group, copyright, author, description, bom-ref and purl came out as null whenever the scan had no value. CycloneDxExternalRef inherited the attrs serialization, which writes comment: null in every externalReferences entry. The CycloneDX schema types all of these as strings, so strict consumers reject the BOM with None is not of type 'string'. The same holds for every published schema from 1.3 to 1.7, so this survives a specVersion bump.

Changes:

• Omit fields with no value in CycloneDxComponent.to_dict() and add a CycloneDxExternalRef.to_dict() that drops a null comment. Empty arrays such as "hashes": [] already validate and are kept.
• Skip packages with no name or version in from_package(), since the 1.3 schema requires both on every component. The existing if not comp: continue in from_packages() now takes effect, and the WARNING property that was appended without ever skipping is gone.
• Regenerate simple-expected.json and simple-npm-expected.json (24 null lines removed), update test_can_encode_component and add three tests.

Validation:

• pytest -vvs tests/formattedcode/test_output_cyclonedx.py: 16 passed, the four updated or new tests fail on develop first
• pytest tests/formattedcode -q: 41 passed, 4 skipped
• Fresh scan of tests/formattedcode/data/cyclonedx/simple-npm validated with cyclonedx-python-lib against the official 1.3 schema: no component errors left, only the metadata property errors tracked in CycloneDX output: metadata.properties[].value emits JSON array instead of string #5349

Two notes: skipped components are dropped silently, surfacing a warning could be a follow-up. And a skipped package can still appear in another component's dependsOn, though the BOM stays schema-valid. Dependency output has a separate pre-existing crash, dependsOn is a Python set and to_json() fails on any scan with dependency data, which I will file separately.

Tasks

• Reviewed contribution guidelines
• PR is descriptively titled 📑 and links the original issue above 🔗
• Tests pass -- look for a green checkbox ✔️ a few minutes after opening your PR
  Run tests locally to check for errors.
• Commits are in uniquely-named feature branch and has no merge conflicts 📁
• Updated documentation pages (if applicable)
• Updated CHANGELOG.rst (if applicable)

Signed-off-by: Shuvagata Dey cymantekfnosz@gmail.com