SBOM generation is wrong when the project uses io.spring.dependency-management plugin to override the dependency versions

I am using initscript cyclonedx to generate sbom for different projects. for one project that uses dependency management to override the transitive dependency versions (to prevent different versions of the same dependency appearing on the project), the sbom generates different versions of the same spring dependency. I checked on the final product only one version is available. so the sbom generation is wrong.

I changed the initscript and put the cyclonedx in the afterEvaluate block to make sure it runs after dependency has been resolved already, it improved a little bit and only one version of dependencies is shown. but again the transitive dependencies version is wrong!!

I have specified the spring-security-oauth2-client version as 3.6.3 which is dependent on the spring-security-web 3.6.3, but in the graph it shows as 3.4.2

- [ ] I am willing to provide a fix
- [x] I will wait until somebody else fixes it

Start by reproducing the issue with the initscript cyclonedx setup and the io.spring.dependency-management override described in the report. Compare the generated SBOM dependency graph with the resolved project graph, especially spring-security-oauth2-client 3.6.3 and spring-security-web; done means the SBOM reports the resolved versions without duplicate or outdated entries.

Written by the indexing model from the issue text.