Incorrect dependency scope resolution when imported Maven bom declares scope

CycloneDX Maven plugin seems to incorrectly resolve the Maven scope of some transitive dependencies when a scope has been declared in an imported Maven bom.

Here is a minimal `pom.xml` to illustrate the problem:
```

4.0.0

com.example
demo
0.0.1-SNAPSHOT
war

io.netty
netty-bom
4.2.13.Final
pom
import

io.netty
netty-all
test

```

With the pom above, some Netty dependencies are resolved in `runtime` scope by Maven (tested with Maven 3.9.14):
```
> mvn org.apache.maven.plugins:maven-dependency-plugin:3.10.0:list
[…]
[INFO] io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.2.13.Final:runtime — module io.netty.transport.epoll.linux
[…]
```
When packaging the `war`, the libs with `runtime` scope are included in `WEB-INF/lib` of the `war`.

The issue is that `mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeBom` doesn’t include any of those Netty libs in the generated `bom.json` / `bom.xml`.

CycloneDX Maven plugin seems to consider them with `test` scope instead of `runtime` scope as they appear if I add `-DincludeTestScope`.

I suspect that something doesn’t work as expected with the CycloneDX Maven plugin and the usage of scope in a bom like [the bom of Netty](https://github.com/netty/netty/blob/b3844c8108b42f68d56144b36d4d1ed96078a688/bom/pom.xml#L348) that is imported (at least with transitive dependencies).

Start by running the minimal pom.xml with Maven 3.9.14 and cyclonedx-maven-plugin:2.9.1:makeBom, then compare bom.json and bom.xml with maven-dependency-plugin:list. Trace how imported BOM scopes are applied to transitive Netty dependencies. Done means runtime-scope libraries appear in the generated BOM without requiring -DincludeTestScope.

Written by the indexing model from the issue text.