Move cdx utils to separate file

[jonringer]

Trying to chunk up cdx1.4 work into more reviewable bites. This is just moving cdx utilities into another file.

[henrirosten]

@jonringer : please check the github action check failure:

error: builder for '/nix/store/sssl0xlv6kjiiizqcn3iqz4yph7s0ph3-pylint.drv' failed with exit code 20;
       last 10 log lines:
       > ************* Module sbomnix.sbomdb
       > src/sbomnix/sbomdb.py:24:0: W0611: Unused LOG_SPAM imported from common.utils (unused-import)
       > ************* Module sbomnix.cdx
       > src/sbomnix/cdx.py:1:0: C0114: Missing module docstring (missing-module-docstring)
       > src/sbomnix/cdx.py:7:0: I0021: Useless suppression of 'too-many-instance-attributes' (useless-suppression)
       > src/sbomnix/cdx.py:7:0: I0021: Useless suppression of 'too-many-arguments' (useless-suppression)
       >

Also note: We have earlier used the convention where a single leading underscore indicates "internal use". E.g. function names with leading underscore by that convention would be expected to be called only inside the module they were declared, see: https://peps.python.org/pep-0008/#descriptive-naming-styles.

We have not enforced this, and might not have followed it rigorously earlier, so not following it does not prevent merging this change. Just something to keep in mind that we might want to later change back to, and for your information in case you wondered why some of those functions were named with a leading underscore.

[jonringer]

Yep, forgot about linting, I'll circle back tomorrow

[henrirosten]

Thanks @jonringer