Preserve CycloneDX 1.7 metadata licenses

[sueun-dev]

Parsing schema-valid CycloneDX 1.7 metadata with a MIT license followed by an Apache-2.0 OR BSD-3-Clause expression retains only one of the two entries in both JSON and XML. Re-serializing the parsed BOM therefore loses document license information.

Metadata still uses LicenseDeserializer: JSON expression parsing replaces earlier entries, while XML license parsing ignores sibling expressions. Use the existing LicenseChoiceDeserializer in MetadataDeserializer and the Metadata.getLicenses() annotation, consistent with the 1.7 license model.

The regression tests cover 1.6 and 1.7 round trips, both license/expression orders, multiple expressions, interleaved XML licenses, and rejection of mixed choices under schema 1.6. The same loss was reproduced with JSON and XML generated by the Gradle plugin's metadata writer, using a local sample configured with both entries; both survive with the patch.

Local checks on Linux aarch64, based on 7ec950fe7773119c18e374f5dcc1c22a30e1c59d:

• mvn -o -B --no-transfer-progress clean test -Dtest=MetadataLicensesTest: 6 failures out of 19 tests before the fix.
• mvn -B --no-transfer-progress clean verify: 1,662 tests passed on each of Temurin 17, 21, and 25, with no test failures, errors, or skips.

CodeQL and hosted coverage reporting were not run locally.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 12 complexity

Metric	Results
Complexity	12

View in Codacy

🟢 Coverage 100.00% diff coverage · +0.27% coverage variation

Metric	Results
Coverage variation	✅ +0.27% coverage variation
Diff coverage	✅ 100.00% diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (7ec950f)	7831	5861	74.84%
Head commit (10de84a)	7831 (+0)	5882 (+21)	75.11% (+0.27%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#946)	1	1	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}