GitHub Dependency Graph Snapshots Add Correct Relationships

I'm a GitHub engineer on the Dependency Graph team.

**What would you like to be added**:

The [GitHub dependency submission API payload ](https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28)specifies a dependencies relationship. It can be either direct or indirect.

However all dependency snapshots submitted via Syft are hardcoded as direct. I can see that's happening [here](https://github.com/anchore/syft/blob/main/syft/format/github/internal/model/model.go#L179-L181).

**Why is this needed**:

When Dependency data is submitted with correct relationships we are able to derive which dependencies are direct and transitive. This gives a more accurate Dependency Graph for a repository and helps with Dependabot and security alerts.

**Additional context**:

I assume Syft derives relations when building SBOMs and uses these artifact relationships [here](https://github.com/anchore/syft/blob/b3e8926025256ef598bfcfa98846fe4eb4273421/syft/artifact/relationship.go#L3-L25) It would be useful to have some confirmation of how/if these relationships map to `direct` and `indirect`

I also assume we would have to use the `SBOM` struct's `Relationship` when building the GitHub model [here](https://github.com/anchore/syft/blob/b3e8926025256ef598bfcfa98846fe4eb4273421/syft/format/github/internal/model/model.go#L69-L96) to calculate the individual packages relationship.

Read syft/artifact/relationship.go and syft/format/github/internal/model/model.go, especially the snapshot package mapping and the SBOM relationship fields. Trace how artifact relationships can map to the GitHub dependency submission API's direct and indirect values. Done means submitted snapshots preserve the correct dependency relationships and the relevant GitHub format behavior is covered by tests.

Written by the indexing model from the issue text.