Clear Distinction between Direct and Transient Dependencies in UI and in Generated SBOMs

### Current Behavior

Currently DT handles direct and indirect dependencies much the same.
In case the loaded BOM has the information DT can show a hierarchy of interdependencies.

However even with this information there is no simple way to identify which dependencies are direct and which are transitive.
The only way I can imagine one would distinguish would be to single out all components for which no other component depends.
Not possible in the UI and not a trivial task via the API either.

PS:
The reason this is important is since organizations may impose very different policies for addressing vulnerabilities raised on direct versus indirect dependencies. Not being able to indicate which dependencies are transient requires teams to treat all as direct until it can be determined that they are not.

### Proposed Behavior

I suggest that DT performs the analysis of the Dependency Tree and marks the direct dependents with a flag.

The CycloneDX format could/should be improved as well to directly include this piece of information.
DT could then include this information in generated SBOM.

The information would be redundant if the dependency tree is included but very helpful and could potentially be provided by the scanner in case it was capable even if it cannot generate the full dependency tree.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested