MergeCommand: add options to --validate-output(-relaxed) …

[jimklimov]

…and optionally avoid writing an invalid document

Came up while testing CycloneDX/cyclonedx-dotnet-library#245 but is a relatively independent feature, given that we juggle several versions of faulty merge generator and JSON validator (in-tree and after respective PR merges).

This little change compiles independently and can also be used to check the original bug for that PR in one command, not two (merge+validate) and even allows to protect the output file from changes ;)

In-tree code sees no evil, hears no evil, does not complain.

Library with validate-json-bomref branch does complain for the same inputs:

...
Processing input file tpb-cucumber-2.5.14-cyclonedx.json
    Contains 180 components
Processing input file tpb-cucumber-2.5.21-cyclonedx.json
    Contains 180 components
Processing input file tpb-cucumber-2.5.26-cyclonedx.json
    Contains 180 components
Processing input file tpb-cucumber-2.6.1-cyclonedx.json
    Contains 184 components
Loaded 317 input document(s) with 28886 components originally (overlaps to merge are possible)      
Beginning merge processing (this can take a while)
Validating merged BOM...
'bom-ref' value of pkg:maven/com.google.errorprone/error_prone_annotations@2.18.0?type=jar: expected 1 mention, actual 3
'bom-ref' value of pkg:maven/io.cucumber/cucumber-core@7.11.0?type=jar: expected 1 mention, actual 2
'bom-ref' value of pkg:maven/io.cucumber/cucumber-gherkin@7.11.0?type=jar: expected 1 mention, actual 2
'bom-ref' value of pkg:maven/io.cucumber/cucumber-gherkin-messages@7.11.0?type=jar: expected 1 mention, actual 2
'bom-ref' value of pkg:maven/io.cucumber/gherkin@26.0.3?type=jar: expected 1 mention, actual 2
'bom-ref' value of pkg:maven/io.cucumber/messages@21.0.1?type=jar: expected 1 mention, actual 2
'bom-ref' value of pkg:maven/io.cucumber/tag-expressions@5.0.1?type=jar: expected 1 mention, actual 2
...
Merged BOM is not valid.
    Total 1352 components


real    1m41.539s
user    0m0.015s
sys     0m0.015s

$ echo $?
6

• note the lack of Writing output file... ;)

FWIW, with the full stack of relevant PRs in discussion applied locally, it is much faster and does dedup well (definition of "well" may vary though, see CycloneDX/cyclonedx-dotnet-library#245):

...
Loaded 317 input document(s) with 28886 components originally (overlaps to merge are possible)      
Beginning merge processing (this can take a while)
Validating merged BOM...
Merged BOM validated successfully.
Writing output file...
    Total 661 components

real    0m17.277s
user    0m0.000s
sys     0m0.046s

[jimklimov]

FYI: This PR is part of a series I've opened 3 years ago, and stalled in review for whatever reasons including the under-the-hood use of reflection to implement inspection of arbitrary BOM entities to merge them, including the ones still open at this time:

• Json/Validator: add findNamedElements() to detect duplicate "bom-ref" definitions cyclonedx-dotnet-library#240
• FlatMerge should deduplicate "equivalent" entries and squash their data cyclonedx-dotnet-library#245
• Bom: initialize its own metadata cyclonedx-dotnet-library#256
• Introduce "cyclonedx rename-entity" command (bis) #396 (revised re-open of Introduce "cyclonedx rename-entity" command #346)
• MergeCommand: use Bom.BomMetadataUpdate()… #340
• MergeCommand: add options to --validate-output(-relaxed) … #335
• MergeCommand.cs: ensure a timestamp and use new cyclonedx-dotnet-library features… #334
• Add "merge --input-file-list NAME ..." as a way to exceed CLI limits #328

I (and my dayjob's budget) have recently employed Claude AI to pick up where I left long ago, and rewrite those changes in idiomatic C#, rebased over current upstream achievements.

After some internal dev-testing shows that this rewrite is successful, I hope these old PRs will be supplanted by a new series with new technological base and same or better feature set as what I was stuck with using (slowly bit-rotting over the years). Hopefully the new set of PRs would be less questionable for an upstream merge :)

I'll add this note to all impacted PRs listed above.