Testcase: Need testcase that has a CDXService with no "bom-ref"

[mrutkows]

with the change to pointers in CycloneDX structs, we need to assure functional path where a service has no "bom-ref" (i.e., marshalled as "nil") will not break future changes. Currently, all JSON test BOMs always have a valid "bom-ref".