Cyclonedx sbom for tycho dependencies

Hi Cyclonedx Team,

Is there any way to scan the Tycho dependencies using cyclonedx-maven-plugin?.

I found that [syft ](https://github.com/anchore/syft) tool can generate cyclonedx format but it has limitations. It does not generate license information.

Thanks,
Swapnil Bharshankar

Start by reviewing the CycloneDX Maven plugin's existing dependency scanning behavior and how it handles Tycho dependencies. Compare the requested result with Syft's stated limitation; the work is done when Tycho dependencies are included in the CycloneDX SBOM with license information.

Written by the indexing model from the issue text.