feat: add npm engine constraint properties

[CAOShurong]

Description

Populate Component.properties from the string-valued entries in a Node
package manifest's engines object. Each entry uses the existing CycloneDX
npm property taxonomy name
cdx:npm:package:constraint:engine:<name>.

Malformed non-string engine constraints are ignored, consistent with the
builder's defensive handling of other package manifest fields.

Fixes issue: #1506

Verification

• npm run test:node (4,166 passing)
• npm run test:lint
• npm run test:standard
• npm run test:dependencies
• npm run build:node
• npm run build:web
• npx tsc -b ./tsconfig.d.json
• npm pack --ignore-scripts, followed by installation into a clean directory
  and runtime checks for valid constraints, malformed values, and a missing
  package name

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: OpenAI Codex
  • LLMs and versions: GPT-5
  • Prompts: Inspect issue #1506 and the repository contribution rules; implement only the required npm engine constraint properties; add positive and malformed-input regression coverage; run build, lint, full tests, package, and clean-install runtime verification.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX JavaScript Library | 🛠️ Build #34100718 | 📁 Comparing 1ffb881 against latest (a573fd8)

  🔍 Preview build  

2 files changed

± changelog.html
± index.html

[CAOShurong]

Both review requests are now in place at exact head dee02ea:

• makeEngineProperties moved inside ComponentBuilder and the generated properties are passed at the bottom of the component options.
• Added regression cases where malformed engines is an array, null and a string (plus the existing non-string-constraint case).

Verification on this head: 8 focused ComponentBuilder tests, 4,155 full node tests, tsc noEmit, eslint, knip dependency checks, node/web/declaration builds, and a real installed-dist probe covering valid, array, null, string and missing engines all pass. CI is now running on the updated head.

Thanks for the review and for applying the HISTORY.md suggestion.

[jkowalleck]

released via https://github.com/CycloneDX/cyclonedx-javascript-library/releases/tag/v10.2.0