Add support for Separation of Concern

When an SBOM describes an application (A) which is built on top of a complex component (B) for which a separate SBOM is available, there is a need to ensure that the the A SBOM does not include inventory from B. Instead A should refer to B as a contained assembly.
Or potentially at a later stage the two should be merged to describe the full set of dependencies for A.

In this way it is clear who is responsible for which parts of the A inventory and any concerns (vulnerability or otherwise) can be addressed by the appropriate parties.

It is (from what we can determine) not possible in the A SBOM generation step to know what parts of the inventory may be covered by some other B SBOM.

So it might be a way forward to add to cyclonedx-cli the ability to "subtract" one SBOM from another. (I.e. to process an SBOM (A) in a way that excludes all inventory covered by an SBOM (B).)