BOM generation does not honor overridden dependency versions

Gradle allows you to specify a version of a transitive dependency if, for example, you need to use a newer version due to a 3rd party vulnerability. However, the generated BOM does not reflect the overridden version.

Here is a complete example:

build.gradle
```groovy
buildscript {
repositories {
mavenCentral()
maven { url 'https://jitpack.io' }
}
}
plugins {
id 'java'
id 'maven-publish'
id 'org.cyclonedx.bom' version "1.2.0"
}

group 'com.example'
version '1.0-SNAPSHOT'

repositories {
mavenCentral()
}

dependencies {
compile("com.amazonaws:amazon-sqs-java-messaging-lib:1.0.8") {
// the amazonaws lib depends on httpclient 4.5.2 which has a vulnerability,
// override it to depend on version 4.5.13 which doesn't have vulnerabilities.
implementation("org.apache.httpcomponents:httpclient:4.5.13") {
because "Older versions have CVEs"
}
}
}

publishing {
publications {
example(MavenPublication) {
from components.java
}
}
}
```

settings.gradle
```groovy
rootProject.name = 'example'
```

To demonstrate, if I run `./gradlew dependencies`, it shows that the transitive dependency version has been overridden with the desired version (as expected):

```
...
runtimeClasspath - Runtime classpath of source set 'main'.
+--- com.amazonaws:amazon-sqs-java-messaging-lib:1.0.8
| +--- com.amazonaws:aws-java-sdk-sqs:1.11.106
| | +--- com.amazonaws:aws-java-sdk-core:1.11.106
| | | +--- commons-logging:commons-logging:1.1.3 -> 1.2
| | | +--- org.apache.httpcomponents:httpclient:4.5.2 -> 4.5.13
...
```

Furthermore, the `build/publications/example/pom-default.xml` that's generated by running `./gradlew generatePomFileForExamplePublication` also shows the overridden version (as expected):
```xml

4.0.0
com.example
example
1.0-SNAPSHOT


com.amazonaws
amazon-sqs-java-messaging-lib
1.0.8
compile


org.apache.httpcomponents
httpclient
4.5.13
runtime

```
([Note](https://docs.gradle.org/current/userguide/dependency_resolution.html) that Maven dependency resolution uses the "nearest first" strategy while Gradle selects the highest version, so in any case, the desired overridden version will be used instead of the old vulnerable one.)

However, the `build/reports/bom.xml` generated by `./gradlew cyclonedxBom` shows the wrong version (unexpected behavior):
```xml

org.apache.httpcomponents
httpclient
4.5.2

required

e0a45df625cb96b69505e59bb25a0189
733db77aa8d9b2d68015189df76ab06304406e50
0dffc621400d6c632f55787d996b8aeca36b30746a716e079a985f24d8074057
6fc7880af7c7f91cdfc81e8c47f84b92c4bc4379ae6c4148be0ece4b14badf48d255093ac6bfa20eb38a612496eca104
c75a4027ca5fe08a1d2b5ac1f632df2fa6d18725dcd45735ac021e19ba24f0438b53f34ee72282f5895a25d3493499bb60d03ccc215797413ca8613ac0918431

pkg:maven/org.apache.httpcomponents/httpclient@4.5.2?type=jar

```

I believe this is a bug in the CycloneDx Gradle plugin, and that the BOM should reflect the overridden version.

Start with the build.gradle and settings.gradle reproduction, then run ./gradlew dependencies, generatePomFileForExamplePublication, and cyclonedxBom to compare resolved versions with build/reports/bom.xml. Trace the dependency data used by the cyclonedxBom entry point; done means the BOM reports httpclient as 4.5.13 rather than 4.5.2.

Written by the indexing model from the issue text.