Add support for pulling in additional dependencies through `externalReferences`

### Current Behavior

It is my understanding that Dependency Track does not currently pull in dependencies specified in [externalReferences](https://cyclonedx.org/docs/1.6/json/#externalReferences). There are a lot of use cases for this, including more complex products.

### Proposed Behavior

The main use cases are `externalReferences` with URLs, in which case it would be great if DT could pull these in. Authentication is of course asn issue here.

`BOM-Link` is also an option in externalReferences, where it perhaps would make sense to have some kind of bundle (zip file?) with a set of SBOMs that can reference each other.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Start with the linked CycloneDX 1.6 externalReferences specification and trace Dependency-Track's existing SBOM ingestion entry point. Clarify the supported URL authentication and BOM-Link bundle behavior before implementation. Done means external references are imported reliably with agreed handling for authentication and referenced SBOMs, with tests covering those cases.

Written by the indexing model from the issue text.