Preserve package properties in CycloneDX output

[abhinavgautam01]

Refs git-pkgs/git-pkgs#307

Summary

• Copy Package.Properties into generated CycloneDX components.
• Preserve properties in both CycloneDX JSON and XML output.
• Add regression coverage for JSON round-tripping and XML encoding.

Motivation

Package.Properties is currently populated and parsed by the SBOM package, but generated CycloneDX documents omit it during encoding.

This is a prerequisite for git-pkgs/git-pkgs#307, which attaches manifest occurrence metadata to SBOM components using indexed properties.

Verification

• gofmt
• go test ./... -count=1

[Copilot]

Pull request overview

This PR ensures Package.Properties are preserved when encoding CycloneDX SBOMs, addressing the gap where properties were parsed/populated internally but dropped from generated CycloneDX output. This aligns the encoder with existing CycloneDX parsing support that already reads component properties back into Package.Properties.

Changes:

• Copy Package.Properties into CycloneDX component.properties during encoding.
• Verify CycloneDX JSON preserves properties via a JSON round-trip regression test.
• Verify CycloneDX XML output includes <properties><property .../></properties> via an encoding regression test.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
encode.go	Adds property propagation from Package.Properties into encoded CycloneDX components.
encode_test.go	Extends fixtures and tests to assert CycloneDX JSON round-trips properties and CycloneDX XML includes the expected <property> element.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.