MergeCommand.cs: ensure a timestamp and use new cyclonedx-dotnet-library features…

[jimklimov]

…to CleanupMetadataComponent() and CleanupEmptyLists() as a finishing touch, to avoid inducing a spec violation with a duplicate bom-ref

The new cleanup features depend on library PR CycloneDX/cyclonedx-dotnet-library#245

[ProlucidPB]

Would love to see this merged in soon!

[Nowcide]

I'd love to see these changes merge, to enable SBOMs to comply with NTIA, NIST and CRA (Cyber Resiliant Act) regulations, which require time stamping as a minimum requirement for SBOMs.

[AlexandreEXFO]

#438

[AlexandreEXFO]

@mtsfoni : Would you have time to review this PR? Please.

[jimklimov]

FYI: This PR is part of a series I've opened 3 years ago, and stalled in review for whatever reasons including the under-the-hood use of reflection to implement inspection of arbitrary BOM entities to merge them, including the ones still open at this time:

• Json/Validator: add findNamedElements() to detect duplicate "bom-ref" definitions cyclonedx-dotnet-library#240
• FlatMerge should deduplicate "equivalent" entries and squash their data cyclonedx-dotnet-library#245
• Bom: initialize its own metadata cyclonedx-dotnet-library#256
• Introduce "cyclonedx rename-entity" command (bis) #396 (revised re-open of Introduce "cyclonedx rename-entity" command #346)
• MergeCommand: use Bom.BomMetadataUpdate()… #340
• MergeCommand: add options to --validate-output(-relaxed) … #335
• MergeCommand.cs: ensure a timestamp and use new cyclonedx-dotnet-library features… #334
• Add "merge --input-file-list NAME ..." as a way to exceed CLI limits #328

I (and my dayjob's budget) have recently employed Claude AI to pick up where I left long ago, and rewrite those changes in idiomatic C#, rebased over current upstream achievements.

After some internal dev-testing shows that this rewrite is successful, I hope these old PRs will be supplanted by a new series with new technological base and same or better feature set as what I was stuck with using (slowly bit-rotting over the years). Hopefully the new set of PRs would be less questionable for an upstream merge :)

I'll add this note to all impacted PRs listed above.