Add source information about de-duplicated components

### Current Behavior

Component de-duplication destroys dependency information. When an SBOM is uploaded from trivy, the retained component is non-deterministic, since trivy assigns a random UUID to the duplicated components. This, in turn, leads to DT picking up a random component, and discarding the other ones. It is not the fault of DT of this non-deterministic behaviour. But it means that component properties like file paths are non deterministic. However, having these properties at your hand can be useful in some few cases.

### Proposed Behavior

Provide the "meta-information" in some way about components. "Meta-information", in this case, are the "non-identifying" components of a component. I guess the best resolution would be to just provide the raw source data of the de-duplicated components, i.e. an accumulated cyclonedx-compatible list of the source components.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested