`gather_metadata` does not preserve tree of dependencies

When generating a Cyclone DX SBOM, it is desirable to model the graph of dependencies [via the `dependencies` attribute](https://cyclonedx.org/docs/1.6/json/#dependencies). The required data is not preserved by our existing providers.

Start by locating gather_metadata and the existing providers mentioned in the issue, then compare the generated CycloneDX SBOM with the CycloneDX 1.6 dependencies attribute. Done means the required dependency data is preserved so the SBOM models the dependency graph.

Written by the indexing model from the issue text.