MergeCommand.cs: ensure a timestamp and use new cyclonedx-dotnet-library features…

[jimklimov]

…to CleanupMetadataComponent() and CleanupEmptyLists() as a finishing touch, to avoid inducing a spec violation with a duplicate bom-ref

The new cleanup features depend on library PR https://github.com/CycloneDX/cyclonedx-dotnet-library/pull/245