`--recursive` is needed to get all development dependencies

The [current documentation](https://github.com/CycloneDX/cyclonedx-dotnet/blob/master/docs/project-references.md) lists that `--recursive` is only needed for old projects:

> For modern SDK-style projects (i.e. all references use `PackageReference`) this produces **the same NuGet package set** as the non-recursive path, because the root assets file already contains everything. The flag is effectively a no-op for the package list in this case.

This is not true. The root assets file doesn't [seem to](https://github.com/CycloneDX/cyclonedx-dotnet/issues/1025#issuecomment-4855762096) contain `PackageReference` dependencies with `PrivateAssets` set to `all` or `ReferenceOutputAssembly` set to `false`. This causes compile-time only dependencies to be missed when `--recursive` is not used.

However, if `--recursive` is set to true along with `--include-project-references`, such dependencies still don't show up as dependencies under project components that depend on them. They end up as components not referenced from anywhere.

Start with docs/project-references.md and the linked discussion in issue 1025, then reproduce the dependency cases involving PrivateAssets=all and ReferenceOutputAssembly=false. Trace the --recursive and --include-project-references entry points to determine why compile-time-only dependencies are omitted or left unreferenced. Done means the documented behavior matches reality and these dependencies appear under the appropriate project components.

Written by the indexing model from the issue text.