`merge`-d polyglot SBOM loses dependency graph information

### Problem overview

CycloneDX tools vary in their support for dependency graph information. For example, `cyclonedx-dotnet`@0.19.0 supports it, while `cyclonedx-node-module` does not due to https://github.com/CycloneDX/cyclonedx-node-module/issues/61.

When merging SBOMs in a polyglot project, such that one or more SBOMs *have* dependency graph information, the output should ideally preserve that, but it currently does not.

To demonstrate this, two projects will be created: one .NET (dependency graph supported) and one NPM (no dependency graph). Their SBOMs, when uploaded individually to Dependency Track, correctly reflect the dependency graph information, if present.

The two SBOMs are then `merge`-d and the output uploaded. The expectation is that the merged SBOM preserves the input files' dependency graph information, whereas it currently seems to be lost.

### Steps to reproduce

Create a simple .NET project and collect its SBOM:

```cmd
> dotnet --version
5.0.401

> dotnet cyclonedx --version
2.1.2.0

> mkdir src\csharp && pushd src\csharp

src\csharp> dotnet new console
The template "Console Application" was created successfully.

src\csharp> dotnet add package Serilog.Sinks.File
info : PackageReference for package 'Serilog.Sinks.File' version '5.0.0' added to file 'src\csharp\csharp.csproj'.
info : Writing assets file to disk. Path: src\csharp\obj\project.assets.json
log : Restored src\csharp\csharp.csproj (in 67 ms).

src\csharp> dotnet cyclonedx -ns -dgl -o .. csharp.csproj
» Analyzing: src\csharp\csharp.csproj
Attempting to restore packages
Retrieving Serilog 2.10.0
Retrieving Serilog.Sinks.File 5.0.0

Creating CycloneDX BOM
Writing to: src\bom.xml
```

Upload `src\bom.xml` to Dependency Track v4.3.6, confirming that the dependency graph information of the .NET project is present, as expected:


Next, create a simple NPM project and collect its SBOM:

```cmd
> npm --version
8.0.0

> cyclonedx-bom --version
3.1.1

> mkdir src\js && pushd src\js

src\js> npm init -y
Wrote to src\js\package.json

src\js> npm install jquery --save-dev
added 1 package, and audited 2 packages in 1s
found 0 vulnerabilities

src\js> cyclonedx-bom -ns -d -o ..\bom-js.xml .
```

Upload `src\bom-js.xml` to Dependency Track; no dependency graph information is present, and this is expected per https://github.com/CycloneDX/cyclonedx-node-module/issues/61:


Finally, `merge` the individual files into a polyglot SBOM:

```cmd
> cyclonedx-win-x64 --version
0.19.0

> cyclonedx-win-x64 merge --input-files src\bom.xml src\bom-js.xml --output-file src\bom-polyglot.xml
Processing input file src\bom.xml
Contains 2 components
Processing input file src\bom-js.xml
Contains 1 components
Writing output file...
Total 3 components
```

Upload `src\bom-polyglot.xml` to Dependency Track.

### Expected results

The dependency graph information present in the input files (e.g. `src\bom.xml`) is preserved in a `merge`-d polyglot SBOM.

### Observed results

Three components are present (as expected), however the dependency graph information is lost: