Transitive dependencies missing in SBOM for multi-module build when Module depends on WAR module

In a multi-module Maven build, transitive dependencies are not resolved correctly in the generated SBOM when a module POM depends on a war or ear module.

What makes this more confusing is that the same transitive dependencies also do not appear in `mvn dependency:tree`. From a user perspective, the resulting SBOM is incomplete because dependencies that are effectively part of the packaged application are missing.

### To reproduce, you need:
- root module [pom.xml](https://github.com/user-attachments/files/25904164/pom.xml)
- sbom submodule [pom.xml](https://github.com/user-attachments/files/25904187/pom.xml)
- war submodule [pom.xml](https://github.com/user-attachments/files/25904199/pom.xml)

Now call `mvn package` or `mvn dependency:tree`

### Expected behaviour:
The sbom module should depend on the test-war module, which then transitively depends on the jakarta.json-api.jar

### Actual behavior:
The generated SBOM is missing transitive dependencies from the war module completely, and the dependency tree shows that too.

### It would be helpful to know:
- whether this is considered a limitation of the CycloneDX Maven Plugin,
- whether this is inherited from Maven dependency resolution behavior,
- and whether there is a recommended workaround for generating a complete SBOM in this kind of project layout.

### Environment:
- CycloneDX Maven Plugin version: 2.9.1
- Maven version: 3.9.11
- Java version: 11.0.30

Start by running mvn package and mvn dependency:tree with the attached root pom.xml, sbom submodule pom.xml, and war submodule pom.xml. Compare the dependency tree and generated SBOM with the expected jakarta.json-api dependency. Trace whether the missing transitive dependency comes from Maven resolution or the CycloneDX Maven Plugin, and document the confirmed behavior or workaround.

Written by the indexing model from the issue text.