Add ATLAS threat taxonomy support

[devashridatta-dotcom]

Summary

Adds MITRE ATLAS as a named threat classification taxonomy for CycloneDX 2.0 threat categories.

• Adds ATLAS to the threat category taxonomy enum.
• Gates ATLAS category values to the 16 ATLAS matrix tactics.
• Extends the existing valid threat model sample with an ATLAS category.
• Adds an invalid taxonomy/category mismatch sample to verify ATLAS does not accept categories from another taxonomy.

Context

Refs #976.

This follows the direction from #956 that AI attack techniques belong in the threat layer, with ATLAS as the natural classification taxonomy. The tactic list follows the current public MITRE ATLAS data, where dist/ATLAS-latest.yaml resolves to dist/v6/ATLAS-2026.07.yaml.

Source: https://github.com/mitre-atlas/atlas-data/blob/main/dist/v6/ATLAS-2026.07.yaml

Validation

• Parsed touched JSON files successfully.
• pnpm run test:v2.0:t2-json-schema-semantic passes.
• Targeted AJV checks pass:
  • ATLAS + credential-access accepted
  • ATLAS + linkability rejected
  • MITRE-ATTACK + initial-access still accepted

Note: pnpm run test:v2.0:t1-json-schema-validate and pnpm run test:v2.0:t3-json-schema-functional still fail before sample validation with the existing unresolved reference:

model/cyclonedx-common-2.0.schema.json#/$defs/extensibleProperties

This same failure is present on the current 2.0-dev test path and is not introduced by this change.

[devashridatta-dotcom]

CI note: I compared the 2.0 schema linter reports from this PR run (33069111642) against the current 2.0-dev baseline run (33003486150, head 72b37340). The failing lint issue paths/messages are identical between the two runs.

This ATLAS taxonomy change does not introduce new 2.0 schema lint findings; the remaining red linter jobs appear to reflect the current 2.0-dev lint baseline rather than this PR's delta.

[jkowalleck]

could you rebase on 2.0-dev branch? you fill find the schema/2.0/model dir being reamed to modules.

[devashridatta-dotcom]

Rebased onto the latest \2.0-dev\ (base \7a3ab082) and force-updated this PR branch. The ATLAS schema change is now under \schema/2.0/modules/cyclonedx-threat-2.0.schema.json, following the model-to-modules rename, and both ATLAS test fixtures remain included. I verified that all three changed JSON files parse, local file references resolve, and \git diff --check\ is clean. GitHub now reports the PR as mergeable; CI has been retriggered.