CycloneDX JSON output keeps absolute paths even if `--base-path` is set

**What happened**:

Setting `--base-path` to the current working directory did not convert absolute paths to relative ones in the CycloneDX JSON output.
Syft was set to generate a SBOM for packages found in the current working directory, so `base-path` should have matched.
Since SPDX JSON correctly converts to relative paths as far as I could see, I assume this is specific to CycloneDX.

**What you expected to happen**:

Absolute paths should be converted to relative ones with respect to `base-path`.

**Steps to reproduce the issue**:

Should work with any project, but for simplicity use the syft repository itself.

1. Run `SYFT_FORMAT_CYCLONEDX_JSON_PRETTY=true syft --base-path=$(pwd) -o cyclonedx-json=cdx_sbom.json ./`
2. Open `cdx_sbom.json`
3. Search for absolute paths being mentioned in the `name` fields of components.

**Anything else we need to know?**:

SPDX JSON output correctly converts absolute paths to relative ones.

**Environment**:
- Output of `syft version`: Tested with v1.41.1 and v1.41.0
- OS (e.g: `cat /etc/os-release` or similar): macOS, but I assume it is OS independent

Start by reproducing the command with --base-path and inspect the CycloneDX JSON output, then compare its path handling with the SPDX JSON output. Locate the CycloneDX JSON formatter and its tests; done means component name paths are relative to base-path and the regression test passes.

Written by the indexing model from the issue text.