feat: mark SBOM from `requirements` as "incomplete"

## Is your feature request related to a problem? Please describe.

when generating an SBOM from a requirements.txt, it is currently not planned to pull transitive depednencies.
therefore, the SBOM might be incomplete.
this shall eb stated via CycloneDX `compositition`

## Describe the solution you'd like

when generating an SBOM from a `requirements.txt`,
for the rtoot component: the dependency composition completeness is set to "incomplete_first_party_only" - see https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf page 59

also: add a CLI flag to set this value according to spec - https://cyclonedx.org/docs/1.6/json/#compositions_items_aggregate

## Describe alternatives you've considered

/

## Additional context

/

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

Comienza en el punto de entrada de generación de SBOM de requirements.txt y revisa cómo se representa el componente raíz. Lee las directrices enlazadas sobre composition de CycloneDX 1.6 y, después, sigue la ruta de la opción de la CLI para establecer el valor agregado. Se considera completado cuando los SBOM basados en requirements informan de la completitud especificada y la CLI puede establecer el valor compatible según la especificación.

Escrito por el modelo de indexación a partir del texto del issue.