feat: mark SBOM from `requirements` as "incomplete"

## Is your feature request related to a problem? Please describe.

when generating an SBOM from a requirements.txt, it is currently not planned to pull transitive depednencies.
therefore, the SBOM might be incomplete.
this shall eb stated via CycloneDX `compositition`

## Describe the solution you'd like

when generating an SBOM from a `requirements.txt`,
for the rtoot component: the dependency composition completeness is set to "incomplete_first_party_only" - see https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf page 59

also: add a CLI flag to set this value according to spec - https://cyclonedx.org/docs/1.6/json/#compositions_items_aggregate

## Describe alternatives you've considered

/

## Additional context

/

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

Start at the requirements.txt SBOM generation entry point and review how the root component is represented. Read the linked CycloneDX 1.6 composition guidance, then trace the CLI option path for setting the aggregate value. Done means requirements-based SBOMs report the specified completeness and the CLI can set the supported value according to the specification.

Written by the indexing model from the issue text.