feat: deserialize single ComponentEvidence.identity

[qkaiser]

The identity field in ComponentEvidence can be either a single object (dict) in CycloneDX 1.5 or a single object/array of objects in CycloneDX 1.6. The previous implementation failed when deserializing a single object format, throwing 'str' object has no attribute 'items' error.

Added _IdentitySetSerializationHelper to properly handle both formats:

• json_normalize: serializes Identity objects as list while preserving view context
• json_deserialize: handles both dict (single) and list (array) formats

Also updated _ComponentEvidenceSerializationHelper.json_denormalize to normalize single dict format to array before deserialization for consistency.

Fixes deserialization of CycloneDX 1.5 and 1.6 SBOMs with component evidence.

The exact error being raised is the following:

AttributeError: There was an AttributeError deserializing JSON to <class 'cyclonedx.model.component.Component'>
the Property <s.oml.SerializableProperty name=evidence, custom_names={}, array=False, enum=False, optional=True, c_type=<class 'cyclonedx.model.component_evidence.ComponentEvidence'>,
type=typing.Optional[cyclonedx.model.component_evidence.ComponentEvidence],
custom_type=<class 'cyclonedx.model.component_evidence._ComponentEvidenceSerializationHelper'>,
xml_attr=False, xml_sequence=24>:
There was an AttributeError deserializing JSON to
<class 'cyclonedx.model.component_evidence.ComponentEvidence'>
the Property <s.oml.SerializableProperty name=identity, custom_names={}, array=True, enum=False, optional=False, c_type=<class 'cyclonedx.model.component_evidence.Identity'>,
type=typing.Set[cyclonedx.model.component_evidence.Identity],
custom_type=None, xml_attr=False, xml_sequence=1>: 'str' object has no attribute 'items'

Which gets triggered when calling Bom.from_json() containing entries like this one:

{
      "type": "library",
      "bom-ref": "pkg:npm/bcryptjs@2.4.3",
      "group": "",
      "name": "bcryptjs",
      "version": "2.4.3",
      "scope": "required",
// --snip--
      "evidence": {
        "identity": {
          "field": "purl",
          "confidence": 1,
          "concludedValue": "package-lock.json",
          "methods": [
            {
              "technique": "manifest-analysis",
              "confidence": 1,
              "value": "package-lock.json"
            }
          ]
        },
      },
    },

[jkowalleck]

Altered the patch, and added new tests for deserialization.
You will find that this is working as intended.

please review the chages, @qkaiser

[qkaiser]

Modifications to the initial patch looks ok to me.

[jkowalleck]

released via https://github.com/CycloneDX/cyclonedx-python-lib/releases/tag/v11.3.0