Support npm dependency resolution for WebJars in generated SBOM

When a Maven project uses a WebJar such as:

```xml

org.webjars
swagger-ui
5.32.6

```

the generated CycloneDX SBOM only contains the WebJar itself: `pkg:maven/org.webjars/swagger-ui@5.32.6`

The npm dependencies of the JavaScript library bundled in the WebJar are not included.

For `org.webjars:swagger-ui`, the JAR does not contain a `package.json`, `package-lock.json`, or Maven dependency information describing the underlying npm dependencies.

This means that vulnerabilities affecting npm dependencies bundled in the WebJar may be missing from the SBOM and therefore from tools such as Dependency-Track or other SBOM-based vulnerability scanners.

Could the Maven plugin support including the npm dependencies of WebJars in the generated CycloneDX SBOM?

Start by tracing how the Maven plugin identifies WebJars and assembles the CycloneDX SBOM. Investigate whether npm metadata can be obtained from the WebJar or another supported source, then define the dependency representation and validation needed. Done means a WebJar such as org.webjars:swagger-ui produces an SBOM containing its underlying npm dependencies.

Written by the indexing model from the issue text.