fix(CycloneDX): parse framework type as library

[DmitriyLewen]

Description

Trivy currently parses only library components of CycloneDX (see https://cyclonedx.org/docs/1.6/json/#components_items_type).
But there are not many differences between a library and a framework and sometimes it is difficult to choose the right type.
Even CycloneDX docs say: If the library also has key features of a framework, then it should be classified as a framework. If not, or is unknown, then specifying library is RECOMMENDED.

So we should parse and scan framework components as libraries.

Discussed in #7418