Add safety integrity level schema support

[devashridatta-dotcom]

Summary

Adds the small first-class safety-integrity classification discussed in #954 for the CycloneDX 2.0 schema line.

• Adds a shared safetyIntegrityLevel schema definition with scheme-gated levels for ISO-26262, IEC-61508, DO-178C, IEC-62304, and EN-50128, plus a custom scheme option.
• Allows safetyIntegrityLevels on blueprint asset classifications and requirements, keeping the assertion scoped to a system/context carrier rather than treating it as an intrinsic component property.
• Adds hazard-analysis and safety-case external reference types for supporting safety evidence.
• Adds EPSS as a vulnerability score method.

Context

This follows the maintainer direction in #954: CycloneDX 2.0 already has first-class structures for safety impact, perspectives, risk, VEX linkage, attestations, and evidence; the remaining gap is a standards-aligned, machine-readable safety integrity classification.

Related: #955.

This also aligns with the SPDX-side direction now represented by spdx/spdx-3-model#1436, where safety integrity is modeled as a contextual relationship-scoped assertion.

Validation

• Parsed all four touched JSON schema files successfully.
• pnpm run test:v2.0:t2-json-schema-semantic passes.
• Targeted AJV checks for safetyIntegrityLevel pass:
  • ISO-26262 + asil-d accepted
  • ISO-26262 + sil-3 rejected
  • IEC-62304 + class-c accepted
  • custom scheme object accepted

Note: pnpm run test:v2.0:t1-json-schema-validate and the functional test currently fail on a clean upstream 2.0-dev checkout with the same unresolved reference:

model/cyclonedx-common-2.0.schema.json#/$defs/extensibleProperties

So that failure appears inherited from the current 2.0-dev test wiring rather than introduced by this change.

[jkowalleck]

could this be moved into cyclonedx-behavior-2.0.schema.json

maybe it is abetter fit.

[devashridatta-dotcom]

Moved safetyIntegrityLevel into cyclonedx-behavior-2.0.schema.json and updated the blueprint/requirement references to point there. Thanks for the direction.