[IDEA] feat: support PEP-770 - bundled (phantom) dependencies

based on https://sethmlarson.dev/early-promising-results-with-sboms-and-python-packages
contact @sethmlarson

PEP: https://peps.python.org/pep-0770/
PEP discussion: https://discuss.python.org/t/pep-770-improving-measurability-of-python-packages-with-software-bill-of-materials/76308

----

## goal

gather the declaration of bundled dependencies of a package, by reading its shipped SBOMs.

> [!WARNING]
> At time of writing, the **PEP 770** is stil a **_draft_**, so it is unclear how declared shipped SBOMs may be detected ...

## expected outcome:

#### Option A

just Bom-Link the Bom(s) found in a package. If they have a serial number

#### Option B

vendor the found BOMS
- bundled dependencies are listed as sub-components of their component in the SBOM result
- each declared bundled dependency is present in the dependency graph-
- dependency graph, if present, of such bundled dependencies is carried over into the SBOM result

### Option C

a combination of the above depending on the evidence

## followup

after implementing this, update the benchmark call andresults in

----

## example result
JSON based on a demo-SBOM for `Pillow==11.1.0`

example JSON

```json
{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"metadata": {
"component": {
"type": "application",
"name": "my-app",
"version": "0.13.37",
"bom-ref": "my-app"
}
},
"components": [
{
"type": "library",
"bom-ref": "pillow==11.1.0",
"name": "Pillow",
"version": "11.1.0",
"components": [
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libXau@1.0.9-3.el8?distro=almalinux-8",
"name": "libXau",
"version": "1.0.9-3.el8",
"purl": "pkg:rpm/almalinux/libXau@1.0.9-3.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/jbigkit-libs@2.1-14.el8?distro=almalinux-8",
"name": "jbigkit-libs",
"version": "2.1-14.el8",
"purl": "pkg:rpm/almalinux/jbigkit-libs@2.1-14.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libtiff@4.0.9-33.el8_10?distro=almalinux-8",
"name": "libtiff",
"version": "4.0.9-33.el8_10",
"purl": "pkg:rpm/almalinux/libtiff@4.0.9-33.el8_10?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libxcb@1.13.1-1.el8?distro=almalinux-8",
"name": "libxcb",
"version": "1.13.1-1.el8",
"purl": "pkg:rpm/almalinux/libxcb@1.13.1-1.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/openjpeg2@2.4.0-5.el8?distro=almalinux-8",
"name": "openjpeg2",
"version": "2.4.0-5.el8",
"purl": "pkg:rpm/almalinux/openjpeg2@2.4.0-5.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libjpeg-turbo@1.5.3-12.el8?distro=almalinux-8",
"name": "libjpeg-turbo",
"version": "1.5.3-12.el8",
"purl": "pkg:rpm/almalinux/libjpeg-turbo@1.5.3-12.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/lcms2@2.9-2.el8?distro=almalinux-8",
"name": "lcms2",
"version": "2.9-2.el8",
"purl": "pkg:rpm/almalinux/lcms2@2.9-2.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/bzip2-libs@1.0.6-26.el8?distro=almalinux-8",
"name": "bzip2-libs",
"version": "1.0.6-26.el8",
"purl": "pkg:rpm/almalinux/bzip2-libs@1.0.6-26.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libpng@1.6.34-5.el8?distro=almalinux-8",
"name": "libpng",
"version": "1.6.34-5.el8",
"purl": "pkg:rpm/almalinux/libpng@1.6.34-5.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/freetype@2.9.1-9.el8?distro=almalinux-8",
"name": "freetype",
"version": "2.9.1-9.el8",
"purl": "pkg:rpm/almalinux/freetype@2.9.1-9.el8?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8",
"name": "libwebp",
"version": "1.0.0-9.el8_9.1",
"purl": "pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8",
"name": "libwebp",
"version": "1.0.0-9.el8_9.1",
"purl": "pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
},
{
"type": "library",
"bom-ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8",
"name": "libwebp",
"version": "1.0.0-9.el8_9.1",
"purl": "pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
}
],
}
],
"dependencies": [
{
"ref": "my-app",
"dependsOn": [
"pillow==11.1.0"
]
},
{
"ref": "pillow==11.1.0",
"dependsOn": [
"pillow==11.1.0|pkg:rpm/almalinux/libXau@1.0.9-3.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/jbigkit-libs@2.1-14.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libtiff@4.0.9-33.el8_10?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libxcb@1.13.1-1.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/openjpeg2@2.4.0-5.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libjpeg-turbo@1.5.3-12.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/lcms2@2.9-2.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/bzip2-libs@1.0.6-26.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libpng@1.6.34-5.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/freetype@2.9.1-9.el8?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8",
"pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
]
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libXau@1.0.9-3.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/jbigkit-libs@2.1-14.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libtiff@4.0.9-33.el8_10?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libxcb@1.13.1-1.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/openjpeg2@2.4.0-5.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libjpeg-turbo@1.5.3-12.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/lcms2@2.9-2.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/bzip2-libs@1.0.6-26.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libpng@1.6.34-5.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/freetype@2.9.1-9.el8?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
},
{
"ref": "pillow==11.1.0|pkg:rpm/almalinux/libwebp@1.0.0-9.el8_9.1?distro=almalinux-8"
}
]
}
```

从 PEP 770 及其链接的讨论开始，然后将 Options A、B 和 C 与项目现有的 package SBOM 行为进行比较。完整的实现应在 SBOM 和依赖关系图中表示捆绑的依赖项，随后更新链接的 sboms-for-python-packages benchmark 中的 benchmark 调用和结果。

由索引模型根据 Issue 内容生成。