support for `maven-shade-plugin`

When using [maven-shade-plugin](https://maven.apache.org/plugins/maven-shade-plugin/), the sbom should likely somehow encode which dependencies are 'embedded' in the jar, and which are 'regular' dependencies.

AFAIK there is no convention on how to express this difference yet in CycloneDX. Likely it would make sense to make use of the [assembly](https://cyclonedx.org/use-cases/#assembly) concept?

I have a test/demo project for this at https://github.com/raboof/maven-shade-sbom/

Start with the linked maven-shade-sbom test/demo project and inspect how the maven-shade-plugin embeds dependencies. Read CycloneDX's assembly use case and determine an agreed representation for embedded versus regular dependencies, then validate the generated SBOM against that decision.

Written by the indexing model from the issue text.