feat(cyclonedx): use evidence.occurrences for file paths instead of FilePath property

CycloneDX has a native field for recording where a component was found:
evidence.occurrences. Use it in CycloneDX output instead of the
proprietary aquasecurity:trivy:FilePath property.

The aquasecurity:trivy:FilePath property is still parsed when scanning
SBOMs generated by older versions of Trivy.

Close #9832

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: kevglynn

integration/testdata/conda-cyclonedx.json.golden

@@ -52,15 +52,18 @@
       ],
       "purl": "pkg:conda/openssl@1.1.1q",
       "properties": [
-        {
-          "name": "aquasecurity:trivy:FilePath",
-          "value": "miniconda3/envs/testenv/conda-meta/openssl-1.1.1q-h7f8727e_0.json"
-        },
         {
           "name": "aquasecurity:trivy:PkgType",
           "value": "conda-pkg"
         }
-      ]
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "miniconda3/envs/testenv/conda-meta/openssl-1.1.1q-h7f8727e_0.json"
+          }
+        ]
+      }
     },
     {
       "bom-ref": "pkg:conda/pip@22.2.2",
@@ -82,15 +85,18 @@
       ],
       "purl": "pkg:conda/pip@22.2.2",
       "properties": [
-        {
-          "name": "aquasecurity:trivy:FilePath",
-          "value": "miniconda3/envs/testenv/conda-meta/pip-22.2.2-py38h06a4308_0.json"
-        },
         {
           "name": "aquasecurity:trivy:PkgType",
           "value": "conda-pkg"
         }
-      ]
+      ],
+      "evidence": {
+        "occurrences": [
+          {
+            "location": "miniconda3/envs/testenv/conda-meta/pip-22.2.2-py38h06a4308_0.json"
+          }
+        ]
+      }
     }
   ],
   "dependencies": [