Description

This PR resolves an issue where the generated sbomreport was not fully compatible with the CycloneDX specification when an expression value was provided without an accompanying license field.

In addition, the PR introduces validation tests that assert the structural correctness of the produced SBOM report. T

Related issues

• Close sbomreport is not CycloneDX compatible #2735

Checklist

• I've read the guidelines for contributing to this repository.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).