fix(cyclonedx): decode evidence occurrence locations

[Eljees]

Description

CycloneDX 1.5+ represents component file locations in the standard evidence.occurrences[].location field. Syft only decoded its proprietary syft:location properties, so locations from third-party CycloneDX BOMs were dropped during import.

This change:

• converts non-empty evidence occurrence locations into Syft file locations
• merges them with existing syft:location properties without changing backward compatibility
• deduplicates repeated locations through the existing LocationSet
• adds component-level and end-to-end CycloneDX JSON decoder regression tests

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Fixes #3880