Consider changing artifactType cardinality to optional

[goneall]

this would be for compatibility with SPDX and perhaps simplify the spec.

Note the related issue in SPDX to add this as a required field (spdx/spdx-spec#171) - one of these approaches (but certainly not both) is needed to make the SBOM and SPDX compatible in 3.0.

[CASTResearchLabs]

this comes from the CycloneDX model
the rationale for having a field and not to infer from relationships is for efficient processing of documents, e.g., to quickly discriminate between hardware, operating system, and software