feat: improve PDM reports reading lock and only report production dependencies

## Describe the solution you'd like

I am considering migrating my poetry projects to pdm to comply with PEP 518 and PEP 631 and be faster (that's what the benchmarks I have seen say).

One obstacle is the way to generate the SBOM, since with poetry it reads the lock and only reports the production dependencies. This does not happen with PDM since its only support is reading a venv.

Start by examining the repository's existing Poetry lock-file handling and the current PDM support, which reportedly reads only a virtual environment. Define how production dependencies should be identified from a PDM lock file, then verify that the generated SBOM excludes development dependencies.

索引モデルが issue の本文から書いたものです。