Wrong metadata.component content in CycloneDX

Picking up the question from https://github.com/anchore/syft/pull/2131#issuecomment-1719529908:

The CycloneDX contains this metadata when using it on a conan lockfile.

```json
"metadata": {
"component": {
"bom-ref": "7ea68ac679dc44fd",
"type": "file",
"name": "conan.lock",
"version": "sha256:sha256:421e3aca902b6310bc89875e13c135843d574a0d01bc399c895fde46ecc16068"
}
}
```

This was the comment from @kzantow:

> This is the "source" you scanned: image, directory, file, etc.. However, this does not really have dependencies to the other components. Creating a graph in CycloneDX is much more limited than in SPDX -- in SPDX we add CONTAINS relationships for this, but the only option in CycloneDX is dependencies, which isn't accurate and we try very hard not to misuse the formats. I'm curious if you add additional dependency entries from the first entry to the other top-level components, does it look to work properly in DependencyTrack?

Now I looked at the CycloneDX webpage:
https://cyclonedx.org/specification/overview/#bom-metadata

> BOM metadata includes the supplier, manufacturer, and *target component* for which the BOM describes. It also includes the tools used to create the BOM, and license information for the BOM document itself.

Based on this, I understand it in the way that `metadata.component` is not the source from where the Bom was generated, but actually the target for which it is generated.

To me it would be more logical to have here specifically a component which is referenced in the components array further down. This is also how https://github.com/CycloneDX/cyclonedx-conan is using it.
And also how it is shown in the examples here:
https://github.com/CycloneDX/bom-examples/blob/master/SBOM/dropwizard-1.3.15/bom.json#L47

*My Question*:
Could it be that syft is wrongly setting the metadata.component entry to the conanfile, instead of the specific component?

Reproduce CycloneDX generation from the conan.lock file and inspect the metadata.component value against the components array. Read the CycloneDX metadata specification and the linked cyclonedx-conan and BOM examples, then determine whether the target component should reference a listed component rather than conan.lock. Done means the behavior is resolved and covered by an appropriate regression test.

Written by the indexing model from the issue text.