Dependencies within Dependency class should be List<String> not List<Dependency>

the `Dependency` class currently contains a dependencies field which is typed as a `List`, which implies that dependencies can be nested. This is incorrect based on both the current specification and the JSON schema, which has "dependsOn" as a list of bom-refs. This can lead to developers believing dependencies can be nested, and producing invalid BOMs as a result.

To double check this, I also compared this with the JavaScript which does implement the dependencies list as a string.