Dependency Track ignores dependsOn tag in CycloneDX format

### Current Behavior: Security Vulnerabilities do not include the dependsOn tag of the CycloneDX file. For example, suppose that we have the following reference and dependsOn field, where component-a has no security vulnerability but b and c have vulnerabilities:
```JSON
{
"ref" : "pkg:maven/component/component-a@0.0.1?type=jar",
"dependsOn" : [
"pkg:maven/component/component-b@0.0.1?type=jar",
"pkg:maven/component/component-c@0.0.1?type=jar"
]
},
```
Dependency Track will not show these relationships to component-a in the vulnerabilities tab. You will only see the component-b/c with a vulnerability risk and component-a will not yield any information that it depends on this software module with the given vulnerability.

### Proposed Behavior: Given the above CycloneDX file and scenario, Dependency Track should log the vulneribility inside component-a too or reference the vulnerability of component-b/c in component-a.