Recommend evidence for `compositions.aggregate`

[prabhu]

Currently, an SBOM could be declared as aggregate=complete without offering evidence. Ideally a suitable evidence must be presented under declarations.evidence for such claims, using the bom-ref as the link.

Currently, only an author is allowed for evidence. This could be enhanced to support tools (components or services) since some of these declarations could be part automated.