cyclonedx-bom is unsuitable for cargo auditable use case

[Shnatsel]

There are several issues that are interfering with using cyclonedx-bom to write CycloneDX in cargo auditable

cargo auditable operates under very different constraints to regular SBOMs; this is what drove me to use a custom format as opposed to using an off-the-shelf CycloneDX or SPDX. The issues currently affecting it are:

• Toplevel version has been made a required field in Update 'version' to be required field #618 and is always written. It needs to be omitted to save bytes.
• Toplevel serialNumber is always written, even if set to None. It needs to be omitted to save bytes.
• dependencies.dependsOn is always written, even if empty. It should be omitted when empty to save bytes.
• There is no way to write a minified JSON. output_as_json_v1_3 and output_as_json_v1_4 pretty-print the JSON, wasting space. The spec module required to implement it outside cyclonedx-bom is private.