Packages pruned by NuGet Package Pruning disappear from the SBOM

This tool relies on `project.assets.json` to list all dependencies in the SBOM. But, this file is affected [by package pruning from .NET 10 onwards](https://devblogs.microsoft.com/dotnet/nuget-package-pruning-in-dotnet-10/):

> ... [package pruning](https://learn.microsoft.com/nuget/consume-packages/package-references-in-project-files#prunepackagereference) removes packages from the restore graph when the .NET Runtime Libraries already provide them.

For example, if you take on a direct dependency to [`System.ServiceModel.Primitives`](https://www.nuget.org/packages/system.servicemodel.primitives/), this includes a transitive dependency to `Microsoft.Extensions.ObjectPool` and `System.Security.Cryptography.Xml`. But, `project.assets.json` will only list `Microsoft.Extensions.ObjectPool` as `System.Security.Cryptography.Xml` is pruned.

Using `--recursive` at least causes the dependency to be linked (since it is retrieved through `PackageReference` instead). However, it still does not link the dependency to where it was pulled in from.

Start by tracing how project.assets.json is read and how --recursive resolves dependencies through PackageReference. Reproduce the pruned System.Security.Cryptography.Xml case, then ensure the SBOM links the dependency to the package that pulled it in, including when NuGet Package Pruning removes it from the restore graph.

Written by the indexing model from the issue text.