Dependencies of dev dependencies end up in SBOM despite `exclude-dev` option

Version: CycloneDX 6.2.0

We have a project with a database layer that references Entity Framework. Some of the packages are development dependencies (PrivateAssets=all), and they are properly recognized as such with the `--exclude-dev` switch. But _their_ dependencies still end up in the SBOM file (including all component details), even though these are not shipped as part of the application.

Simplified project file:
```xml

net10.0

all
runtime; build; native; contentfiles; analyzers; buildtransitive



all
runtime; build; native; contentfiles; analyzers; buildtransitive

```

Command line and output:
```
D:\sbom-devdep-repro>dotnet cyclonedx Database.csproj -o sbom --exclude-dev --set-nuget-purl -spv 1.6

Found the following local nuget package cache locations:
C:\Users\username\.nuget\packages\
Scanning at D:\sbom-devdep-repro\Database.csproj

» Analyzing: D:\sbom-devdep-repro\Database.csproj
Attempting to restore packages
Packages restored
Found Assetsfile under D:\sbom-devdep-repro\obj\project.assets.json
Found 34 packages
2 packages being excluded as DevDependencies

Creating CycloneDX BOM
Writing to: D:\sbom-devdep-repro\sbom\bom.xml
```

Snippets from the resulting `bom.xml`:
```xml

```
```xml

Humanizer.Core
2.14.1

Microsoft.Build.Framework
18.0.2

```

You can see that the direct dependencies of Database are correctly set, but the dependencies of dev dependencies still show up.

Reproduce the issue with Database.csproj using `dotnet cyclonedx Database.csproj -o sbom --exclude-dev --set-nuget-purl -spv 1.6`, then inspect the generated bom.xml. Trace how PrivateAssets=all packages and their transitive dependencies are selected; done means dev dependencies and their dependencies are absent from both components and dependency entries when `--exclude-dev` is used.

Written by the indexing model from the issue text.