fix(cyclonedx): trim non-URL characters

[knqyf263]

Description

Some advisories include invalid URLs, breaking CycloneDX.

e.g. https://github.com/andk/cpanpm/commit/9c98370287f4e709924aee7c58ef21c85289a7f0 (2.35-TRIAL)

The advisory contains the above string as a URL, so it should be their problem. However, we will trim the non-URL characters so that Trivy users are not disadvantaged by the problem.

Discussed in #6224

[black-snow]

Excellent! I reported some bad URLs but without any echo so far. Any mitigation on our side would be a lifesaver.
ref: #6663

[RichieB2B]

Thanks for fixing this.
Just to make sure: trimming at the first non-URL character seems like the right solution, not URL-encoding them as #6790 suggests.