Flat merging can result in duplicate BOM refs

Not sure how to handle this. For hierarchical merging the top level component information can be used to "namespace" BOM refs.

Maybe requires supporting passing in namespace values for each BOM or optionally generating a random namespace.

I personally don't like the latter as it will drastically change BOM refs between runs. But maybe that's not really an issue given they are just used to identify elements within a single instance of a BOM.

Start by reviewing flat merging and how BOM refs are assigned, then compare this with hierarchical merging and its use of top-level component information for namespacing. Done means the project has an agreed, deterministic way to prevent duplicate BOM refs when BOMs are flat-merged.

Written by the indexing model from the issue text.