Add support for supplementing POM models

The quality of the generated SBOM strongly depends on the quality of a project's POM file and the POM files of its dependencies. In the short term it is impossible to fix the POM files of dependencies, so it would be useful to have a mechanism to override the effective POMs of those dependencies for the purposes of generating an SBOM.

The [Maven Remote Resources Plugin](https://maven.apache.org/plugins/maven-remote-resources-plugin/index.html) already provides such a mechanism in the form of a [`supplemental-models.xml` file](https://maven.apache.org/plugins/maven-remote-resources-plugin/supplemental-models.html). This file format could also be reused by the CycloneDX Maven Plugin.

Start by reading the Maven Remote Resources Plugin supplemental-models.xml format and the CycloneDX Maven Plugin's POM-processing flow. Determine where supplemental models can be loaded and applied to dependency effective POMs, then verify that generated SBOM metadata reflects those overrides.

Written by the indexing model from the issue text.