feat: mark SBOM from `requirements` as "incomplete"

## Is your feature request related to a problem? Please describe.

when generating an SBOM from a requirements.txt, it is currently not planned to pull transitive depednencies.
therefore, the SBOM might be incomplete.
this shall eb stated via CycloneDX `compositition`

## Describe the solution you'd like

when generating an SBOM from a `requirements.txt`,
for the rtoot component: the dependency composition completeness is set to "incomplete_first_party_only" - see https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf page 59

also: add a CLI flag to set this value according to spec - https://cyclonedx.org/docs/1.6/json/#compositions_items_aggregate

## Describe alternatives you've considered

/

## Additional context

/

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

从 requirements.txt 的 SBOM 生成入口开始，检查根组件是如何表示的。阅读链接的 CycloneDX 1.6 composition 指南，然后跟踪用于设置聚合值的 CLI 选项路径。当基于 requirements 的 SBOM 报告指定的完整性，并且 CLI 能够根据规范设置受支持的值时，即视为完成。

由索引模型根据 Issue 内容生成。