Investigate generation of CycloneDX documents for Qt build SBOM

Qt 6.8 generates SPDX v2.3 documents.

Some SBOM processing tools like DependencyTrack
https://github.com/DependencyTrack/dependency-track

can only process CycloneDX SBOMs.

We should investigate how easy it would be to either convert the SPDX v2.3 documents to CycloneDX, or generate them from scratch as an alternative implementation of the our existing CMake SPDX SBOM API.

There exists a tool that claims converting SPDX v2.2 documents to CycloneDX, but in practice it doesn't do a good job.
Most information gets lost or converted into a "comment"-like field that is not processed properly by tools.
https://github.com/CycloneDX/cyclonedx-cli