fix: CycloneDX SBOM with externalReferences that are not related to CPEs, generate new #5827

    def parse_ext_ref(self, ext_ref) -> list[tuple[str | None, str | None, str | None]]:
        """
        Parse external references in an SBOM to extract module information.

        Two passes are made through the external references, giving priority to CPE types,
        which will always match the CVE database.

        Args:
        - ext_ref (List[List[str]]): List of lists representing external references.
          Each inner list contains [category, type, locator].

        Returns:
        - Optional[Tuple[str | None, str | None, str | None]]: A tuple containing the vendor, product, and version
          information extracted from the external references, or None if not found.

        """
        decoded = {}
        results = []
        for ref in ext_ref:
            ref_type = ref[1]
            ref_string = ref[2]
            if ref_type == "purl":
                # Validation of purl is performed implicitly within the decode_purl function
                decoded["purl"] = self.decode_purl(ref_string)

            if ref_type == "cpe23Type" and self.is_valid_string("cpe23", ref_string):
                decoded["cpe23Type"] = decode_cpe23(ref_string)

            if ref_type == "cpe22Type" and self.is_valid_string("cpe22", ref_string):
                decoded["cpe22Type"] = decode_cpe22(ref_string)

        # No ext-ref matches, return none
        if decoded.get("purl") is not None:
            LOGGER.debug("Found PURL")
            results.append(decoded.get("purl"))

        if decoded.get("cpe23Type") is not None:
            LOGGER.debug("Found CPE23")
            results.append(decoded.get("cpe23Type"))

        if decoded.get("cpe22Type") is not None:
            LOGGER.debug("Found CPE22")
            results.append(decoded.get("cpe22Type"))

        if results == []:
            LOGGER.debug("Nothing found")
            results.append([None, None, None])

        return results
[...]
    def parse_cyclonedx_spdx(self) -> [(str, str, str)]:
[...]
            # If Package URL or CPE record found, use this data in preference to package data
            ext_ref = package.get("externalreference")
            if ext_ref is not None:
                external_references = self.parse_ext_ref(ext_ref=ext_ref)
                # Store the data for each external reference
                for vendor, package_name, version in external_references:
                    # For any data not found in CPE or the Package URL get from package data
                    if not vendor:
                        pass  # Because no vendor was detected then all vendors with this named package
                        # will be included in the output.

                    if not package_name:
                        package_name = package["name"]

                    if (not version) and (package.get("version") is not None):
                        version = package["version"]
                    elif version is None:
                        LOGGER.debug(f"No version found in {package}")

                    if version:
                        # Found at least package and version, save the results
                        modules.append([vendor, package_name, version])