feat: Add support for TLP marking in metadata

[anthonyharrison]

As discussed in ticket #595, this PR adds TLP marking in the BOM metadata.

This PR superseeds #603

fixes #595

[jkowalleck]

could you add some documentation here and there, and properly set the default values?

[jkowalleck]

for backwards compatibility reasons, i would not set "CLEAR" as the default value.
I'd prefer a unset as default.

clean means a decision actively was made, right?

in JSON, this would mean no default is defined, and the property is optional.
in XML, this would mean no default is defined, and the element is optional.
in protobuf, this would mean adding a case TLP_UNSPECIFIED = 0;, and the field is optional.

[anthonyharrison]

for backwards compatibility reasons, i would not set "CLEAR" as the default value. I'd prefer a unset as default.

clean means a decision actively was made, right?

in JSON, this would mean no default is defined, and the property is optional. in XML, this would mean no default is defined, and the element is optional. in protobuf, this would mean adding a case TLP_UNSPECIFIED = 0;, and the field is optional.

I see CLEAR as the default when the user makes no choice as the user is more likely to explicitly state one of the other values (which indicates that he has thought about the constraints as regards sharing the BOM). Personally, I would prefer to see all BOMs to have the TLP value explicitly stated but that is possibly too much to expect at this stage.

[jkowalleck]

I'll try to fix the open issues ASAP

[jkowalleck]

@anthonyharrison, the current state looks promising.

According to the CycloneDX working model, the next step would be to move from "prototype" to "draft", meaning the community review phase (RFC) would start.
Do you want to change anything, or should we move to RFC?

[anthonyharrison]

@jkowalleck Let's go to the next stage and see what the community thinks. I have no outstanding changes.

[jkowalleck]

RFC notice sent.

• https://groups.io/g/CycloneDX/message/307
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1742068954697559

Public RFC period ends April 13, 2025

[jkowalleck]

All current discussuons are basically too late. Public RFC ended on 13. of April.

This feature is promoted to become standardized under Ecma. Vote will be on 1. May.

Please do not alter the current state last minute.
FYI : If you want to alter things, we will restart the month long RFC phase and then wait another month or so for Ecma.

[jkowalleck]

This feature was just appoved by Ecma TC54 👍