CycloneDX SBOMs do not contain dependencies

As part of the ScanCode <=> ORT integration (see https://github.com/aboutcode-org/scancode.io/issues/1727) I tested analyzing [Mime Types 2.1.26](https://github.com/jshttp/mime-types/tree/2.1.26) as various inputs to ScanCode.io. v35.3.0 and to my surprise noticed that dependencies detected included in SPDX SBOM but not in CycloneDX SBOM. Is this expected behavior for some of ScanCode.io built-in pipelines?

| Test nr| Input | Pipeline | # Packages | # Deps | # Resources | # Deps in CycloneDX SBOMs | # Deps SPDX SBOMs |
|--|---|---|---|---|---|---|---|
|1| pkg:npm/mime-types@2.1.26 | scan_codebase | 1 | 9 | 8 | 0 | 9|
|2| pkg:npm/mime-types@2.1.26 | scan_single_package | 1 | 9 | 6 | 0 | 9 |
|3| pkg:npm/mime-types@2.1.26 | inspect_packages | 1 | 9 | 8 | 0 |9 |
|4| pkg:npm/mime-types@2.1.26 | resolve_dependencies | 2 | 27 | 8 | 0 | 27 |
|5| pkg:github/jshttp/mime-types@2.1.26 | scan_codebase | 1 | 9 | 15 | 0 | 9 |
|6| pkg:github/jshttp/mime-types@2.1.26 | scan_single_package | 1 | 9 | 12 | 0 | 9 |
|7| pkg:github/jshttp/mime-types@2.1.26 | inspect_packages | 1 | 9 | 15 | 0 | 9 |
|8| pkg:github/jshttp/mime-types@2.1.26 | resolve_dependencies | 0 | 0 | 15 | 0 | 27 |

Attached [scancode-io-tests.zip](https://github.com/user-attachments/files/22463897/scancode-io-tests.zip) contains all the ScanCode.io project files and SBOMs from my tests.