Dependencies within Dependency class should be List<String> not List<Dependency>

the `Dependency` class currently contains a dependencies field which is typed as a `List`, which implies that dependencies can be nested. This is incorrect based on both the current specification and the JSON schema, which has "dependsOn" as a list of bom-refs. This can lead to developers believing dependencies can be nested, and producing invalid BOMs as a result.

To double check this, I also compared this with the JavaScript which does implement the dependencies list as a string.

Start by locating the Dependency class and inspecting its dependencies field against the current specification and JSON schema, where dependsOn is a list of bom-refs. Compare the corresponding JavaScript implementation, then verify that the Java model represents dependency references as strings and no longer suggests nested dependencies.

Vom Indexierungsmodell aus dem Issue-Text verfasst.