Support capability for a consumed dependency to declare effective dependencies in its pom

### Feature request

This is a feature request for a mechanism for a POM to be able to declare "non obvious" extra dependencies in a way that a consuming project would pick up and include in an aggregate pom.

### Example use case

As a company we use jlink to convert an openJDK into a JRE which we then package with our products. This appears in an aggregate bom as follows

mirada.package
jre
11.0.6.10-1-20200415.133922-10
....

From a certain perspective this is correct, as this is what we called the resulting jre when we uploaded it to our private maven repository.

However, uploading this to tools like OWASP dependency track isn't very useful, as it doesn't know what mirada.package/jre is, or its weird version number we've given it.

It would be useful if in the pom for mirada.package:jre we had been able to indicate that it itself depends on oracle:openjdk:11.0.6 (Not sure if oracle is right..., doesn't really matter anyway). So an aggregate bom would list that out as well as the weird packaged one and OWASP dependency track would alert us to problems in the JRE.

I could potentially try to write this myself (assuming its a desired feature) but I'm not totally sure what the way in which the dependency's pom should declare itself as having extra dependencies such that cycloneDX could pick them up so might need a steer there

No source files or tests are named. Start by tracing how the plugin reads consumed Maven dependency POMs and builds an aggregate BOM, then determine how a dependency could declare extra effective dependencies; done means those dependencies appear alongside the packaged component without breaking existing BOM output.

Written by the indexing model from the issue text.