fix: move distribution hashes where they belong (#1120)

* Fixed
  * SBOM results might have the `externalReferences[].hashes` populated ([#1118] via [#1120])  
    The hashes might have wrongly appeared as `components[].hashes` before.
* Misc
  * Raised dependency `@cyclonedx/cyclonedx-library@^6.1.0`, was `@^3||^4||^5||^6` (via [#1120])

[#1118]: #1118
[#1120]: #1120

fixes #1118

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

HISTORY.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
+* Fixed
+  * SBOM results might have the `externalReferences[].hashes` populated ([#1118] via [#1120])  
+    The hashes might have wrongly appeared as `components[].hashes` before.
+* Misc
+  * Raised dependency `@cyclonedx/cyclonedx-library@^6.1.0`, was `@^3||^4||^5||^6` (via [#1120])
+
+[#1118]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/1118
+[#1120]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1120
+
 ## 1.14.1 - 2023-09-18
 
 * Fixed