transformer: omit serial number

The serial number is not required per spec but only recommended. Since,
by default, it is generated randomly, it prohibits reproducibility.

rust/transformer/src/cyclonedx.rs

@@ -26,6 +26,8 @@ impl CycloneDXBom {
         Self(Bom {
             components: Some(components.into()),
             metadata: Some(metadata_from_derivation(target)),
+            // Do not include a serial number to improve reproducibility.
+            serial_number: None,
             ..Bom::default()
         })
     }