Enhancement request: Retain transitive relationship between packages when importing SBOM

**Is your enhancement request related to a problem? Please describe.**
DejaCode allows to load packages associated with a product from an SBOM. A modern SBOM that fulfills requirements such as [BSI TR-03183](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2.pdf?__blob=publicationFile&v=5) will have to list transitive dependencies, meaning that not just the immediate dependencies used by the product are included, but also the ones they depend on and so on until all indirect dependencies are listed as well. When DejaCode imports the packages from the SBOM it only associates them directly with the product, all information about the transitive nature between packages is completely lost. The SBOM exported from DejaCode will list all dependencies as if they were direct dependencies of the product. As such it is not an accurate SBOM and does not fulfill current regulations.

**What are the benefits of the requested enhancement?**
The exported SBOM would provide accurate information. Currently, it does not reflect the actual status of the dependencies and as such is not an SBOM that fulfills regulation such as the Cyber Resilience Act or NTIA Minimum Elements for a Software Bill of Materials persuant to Executive Order 14028 as well as other national standards/technical guidelines.

**Describe the solution you would like**
It would be highly important that DejaCode retains the relationships between packages by storing the hierarchy in the context of the product. The exported SBOM for the product should retain the hierarchy that was provided when importing the SBOM.

The indirect dependencies for a package may seem fixed for a particular package version that is a direct dependency. However, there are uses cases where some of the transitive dependencies could get intentionally excluded, especially for Java software. Thus my recommendation would be to have this mapping in the product and not in the package itself.

**Additional notes**
Example data for an SBOM imported into DejaCode and the result after exporting it. Notice that `dependencies` has turned into a flat list.

Imported SBOM:
- [sbom-1-4-formatted.cdx.json](https://github.com/nexB/dejacode/files/15332239/sbom-1-4-formatted.cdx.json)

Exported SBOM:
- [dejacode_beta-systems_product_dejacode-transitive-dependencies-3_0.0.1.cdx.json](https://github.com/nexB/dejacode/files/15332243/dejacode_beta-systems_product_dejacode-transitive-dependencies-3_0.0.1.cdx.json)