[Defect] nistQuantumSecurityLevel permits undefined value 6 #1185

As discussed in the meeting, the CycloneDX 1.6, 1.7, and 2.0 JSON schemas allow nistQuantumSecurityLevel values from 0 to 6.
However, NIST defines categories 1–5, and CycloneDX uses 0 when none of these categories are met. The meaning of 6 remains undefined.

I suggest limiting the 2.0 range to 0–5, unless 6 has an intended meaning. Released 1.x schemas should be considered separately to avoid compatibility issues.

We should also add boundary tests and check consistency across JSON, XML, and Protobuf.

Related: #1175 and #1177 cover omission vs. zero, while this issue concerns the undefined value 6.