Some compile/runtime dependencies missing from SBOM

I recently introduced CycloneDX SBOM creation in our projects. Comparing the contents of the SBOM with what `mvn dependency:list` spits out, I found that the SBOM was missing a number of dependencies.

One thing the missing dependencies all have in common is that `mvn dependency:tree` has them in a tree branch under `test` scoped dependencies, despite the dependencies themselves being in `compile` or `runtime` scope. This is a result of the Maven analyzer's tree path pruning, only showing the first transitive path for each dependency:

```
de.postadress.star:star-validator:jar:0.1.1-SNAPSHOT
+- de.postadress.star:star-commons-cucumber:jar:0.1.1:test
| +- org.glassfish.jaxb:jaxb-runtime:jar:4.0.9:runtime
| | \- org.glassfish.jaxb:jaxb-core:jar:4.0.9:runtime
| | +- org.eclipse.angus:angus-activation:jar:2.0.3:runtime
| | +- org.glassfish.jaxb:txw2:jar:4.0.9:runtime
| | \- com.sun.istack:istack-commons-runtime:jar:4.1.2:runtime
```

This is a bit simplified, but essentially `star-commons-cucumber` is a test library that depends on a bunch of non-test libraries like `org.glassfish.jaxb:jaxb-runtime`, which are also pulled into the root project through non-test transitive dependencies.

All the missing dependencies look like this. However, one interesting detail is that there are other dependencies that show up the same in the dependency tree, but get perfectly included in the SBOM:

```
de.postadress.star:star-validator:jar:0.1.1-SNAPSHOT
+- de.postadress.star:star-commons-cucumber:jar:0.1.1:test
| +- org.springframework.boot:spring-boot-jdbc:jar:4.0.7:test
| | +- org.springframework.boot:spring-boot-sql:jar:4.0.7:test
| | +- org.springframework.boot:spring-boot-transaction:jar:4.0.7:compile
| | | +- org.springframework.boot:spring-boot-persistence:jar:4.0.7:compile
| | | \- org.springframework:spring-tx:jar:7.0.8:compile
```

If it were just the interleaved test dependencies, one would expect `org.springframework:spring-tx` to be missing from the SBOM as well, but it is present and accounted for.

I guess this comes down to "Maven's analyzer is weird", but then again, `dependency:list` manages to get a correct list.

Our cyclonedx config:

```

org.cyclonedx
cyclonedx-maven-plugin
2.9.1

application
1.6

true
true
true
true
true
false

json
application.cdx


```

This runs the cyclonedx generation pretty early. I tried running it in the package or verify phases, but that didn't change anything. Of course, with `true` the SBOM is complete, but including all the test dependencies.

Reproduce the report with the CycloneDX Maven plugin configuration shown, especially the compile, runtime, and test scope settings. Compare the generated SBOM with Maven's dependency:list and dependency:tree output, focusing on dependencies whose only displayed path passes through a test-scoped dependency. Done means compile and runtime dependencies are included without including test-only dependencies.

Written by the indexing model from the issue text.