fix(sbom): cyclonedx advisory should omit null value

[DmitriyLewen]

Description

Explicitly set nil for empty refs slice for Cyclonedx Advisories to avoid

      "id": "CVE-2023-41105",
      ...
      "advisories": null,

This case happens because we use pointer of not nil Object - Type == []cdx.Advisory, Value == nil.

Some simple example - https://go.dev/play/p/M-06dbzzkGB

Related issues

• Close bug(cyclonedx): cyclonedx vulnerability advisory == null #5039

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

We already have too many tests for CycloneDX. Can we leverage the existing one?

[knqyf263]

Or we can add a new test just to validate the CycloneDX schema.

[DmitriyLewen]

I think for now we can use existing testcase, and also we have validation in integration tests (i added 1 testcase with vulnerabilities to validate vulnerability fields).

I used existing testcase in af908f3