Syft is dropping the "group" field from imported CycloneDX

This is based on research with @wurstbrot. It might be an issue with syft, or the CycloneDX library.

By taking a look at the output of the javascript cataloger, it doesn't use group (specified in . It places the group in front of the name.
I am using the following components/flow:
cyclonedx/cyclonedx-npm (uses group) -> image -> syft (doesn't support group) with https://github.com/CycloneDX/cyclonedx-go (does support groups) -> new-bom.json (without group attribute/prefix in name)

Is there a reason that syft doesn't use the specified group in a [package](https://github.com/anchore/syft/blob/main/syft/pkg/package.go#L16)? The cycloneDX specification uses
a group https://cyclonedx.org/docs/1.4/json/#components_items_group?

A workaround might be to do make the bom.json it like the javascript cataloger uses it and add the group in front of the name and remove the group attribute.

_Originally posted by @wurstbrot in https://github.com/anchore/syft/issues/1029#issuecomment-1241818307_

Start at syft/pkg/package.go and trace the CycloneDX import flow, comparing it with the JavaScript cataloger output and cyclonedx-go's group support. Reproduce the cyclonedx-npm → image → Syft → new-bom.json flow; done means the handling of the CycloneDX group field is explained and the resulting behavior is addressed.

Written by the indexing model from the issue text.