Relationships / Dependencies are present in Syft json and SPDX json files but sometimes not in Cyclonedx json file format

**What happened**:
I am not seeing dependencies information on CycloneDX format json files even though they are present in other formats:

SPDX file snippet:
```json
"relationships": [
{
"comment": "evident-by: indicates the package's existence is evident by the given file",
"relatedSpdxElement": "SPDXRef-File--Install-LMFIN-10010154-001574.jar-39b2fbb066459eaa",
"relationshipType": "OTHER",
"spdxElementId": "SPDXRef-Package-java-archive-org.eclipse.osgi-0988631922bb71dc"
},
{
"comment": "evident-by: indicates the package's existence is evident by the given file",
"relatedSpdxElement": "SPDXRef-File--Install-LMFIN-10010154-001574.jar-39b2fbb066459eaa",
"relationshipType": "OTHER",
"spdxElementId": "SPDXRef-Package-java-archive-org.eclipse.equinox.http.servletbridge-1.0.100.v20090520-0fa41529ebc92c19"
},
{
"relatedSpdxElement": "SPDXRef-Package-java-archive-defaultHelp-25eed61145441535",
"relationshipType": "CONTAINS",
"spdxElementId": "SPDXRef-DocumentRoot-File-Install-LMFIN-10010154-001574.jar"
},
{
"relatedSpdxElement": "SPDXRef-Package-java-archive-el-4ab927d37eec02be",
"relationshipType": "CONTAINS",
"spdxElementId": "SPDXRef-DocumentRoot-File-Install-LMFIN-10010154-001574.jar"
},
```
**What you expected to happen**:
Dependencies should appear in the Cyclonedx format json file similar to SPDX and Syft json files.

**Steps to reproduce the issue**:
I tried generating SBOM file in CycloneDX format and noticed that no dependencies are included in the sbom file. But then I tried generating an SBOM in Syft json and SPDX json formats and see that relationships / dependencies information are present. I tried converting the SBOM to CycloneDX format and no dependencies information are included in the output.

**Anything else we need to know?**:
N/A

**Environment**:
- Output of `syft version`:
Application: syft
Version: 1.2.0
BuildDate: 2024-04-12T18:31:58Z
GitCommit: dde5d349b1eef740c285255e6a9e3a8f5c9938e1
GitDescription: v1.2.0
Platform: windows/amd64
GoVersion: go1.21.9
Compiler: gc

- OS (e.g: `cat /etc/os-release` or similar):
Windows 11 Enterprise

Start by reproducing the CycloneDX JSON generation and conversion described in the issue with Syft 1.2.0, then compare its dependency relationships with the Syft JSON and SPDX outputs. Trace the CycloneDX output path to determine where relationships are omitted; done means dependencies appear consistently in the CycloneDX JSON output.

Written by the indexing model from the issue text.