Vcpkg dependencies detected via vcpkg.spdx.json but not attributed to vcpkg.json (Explicitly Referenced is 0, despite valid manifest-info.json)

Nobody has claimed this yet.

### Summary

When running Microsoft SBOM Tool 4.1.5 (which uses Component Detection 6.2.1) against a manifest-mode Vcpkg project (built with Vcpkg 2026-07-27-98d7cb0cf1f4686a3e43aa5672b6230c1d56bce8), the Vcpkg dependencies are detected from the generated `vcpkg.spdx.json` files, but they are not attributed to the project's `vcpkg.json`.

### As a result

- Vcpkg dependencies appear under Components Found, but Explicitly Referenced remains 0
- The detector appears to ignore a valid `manifest-info.json`
- `telemetry.json` contains no references to `manifest-info.json`, `manifest-path`, or `vcpkg.json`
- The SPDX output is missing the Vcpkg dependencies

According to the [Vcpkg detector documentation](https://github.com/microsoft/component-detection/blob/main/docs/detectors/vcpkg.md), `manifest-info.json` is used to associate dependencies discovered from `vcpkg.spdx.json` with the originating `vcpkg.json`. Since that attribution support was added in #1408 and #1436, in Component Detection 5.2.26, I regression tested with Microsoft SBOM Tool 4.1.3 (which used 5.2.27) and 4.1.4 (which used 6.0.0) and confirmed that all three versions exhibit the issue (it has not worked from the beginning - it is not a regression).

### Repository Layout
```
.
├─ vcpkg.json
├─ vcpkg_installed
│ └─ x64-windows
│ └─ vcpkg
│ │ ├─ manifest-info.json
│ │ └─ vcpkg-lock.json
│ └─ x64-windows
│ └─ share
│ ├─ libyuv
│ │ └─ vcpkg.spdx.json
│ ├─ gstreamer
│ │ └─ vcpkg.spdx.json
│ └─ ...
```

### vcpkg.json
```
{
"dependencies": [
{
"name": "libyuv",
"version>=": "1857"
},
{
"name": "gstreamer",
"version>=": "1.22.5"
},
{
"name": "gst-rtsp-server",
"version>=": "1.20.5"
}
],
"builtin-baseline": "ce613c41372b23b1f51333815feb3edd87ef8a8b"
}
```
Also tried (same result)
```
{
"dependencies": [
"libyuv",
"gstreamer",
"gst-rtsp-server"
]
}
```

### manifest-info.json
```
{
"manifest-path": "C:\\git\\myrepository\\vcpkg.json"
}
```

### Command line used
From the repository root:
```
sbom-tool generate `
-li true `
-b .\myfrontend\release\win-unpacked `
-bc . `
-m .\myfrontend\release `
-pn "mysoftware" `
-pv "1.0.0" `
-ps "My Company" `
-nsb "https://mysoftware.com" `
-t telemetry.json
```

### Investigation done

Tests to show that detection works, but attribution does not:

- Output shows Components Found: 56, Explicitly Referenced: 0
- Verified that the generated SPDX contains expected entries like SPDXRef-port and SPDXRef-binary
- Tried renaming `vcpkg-lock.json` and found no change in the Components Found or Explicitly Referenced
- Tried renaming all `vcpkg.spdx.json` files to confirm that is where it is getting Components Found, which resulted in 0 found
- Verified that `telemetry.json` contains no references to `manifest-info.json`, `manifest-path`, or `vcpkg.json`
- Researched vcpkg_installed layout differences under VS integration

### Issue 1

The detector doesn't understand the `vcpkg_installed` layout for the VS2022/2026 integrated configuration (`vcpkg integrate install`):

- Using `-V Verbose` output, we can see it discovers the `manifest-info.json`, but doesn't read it in because it doesn't understand the additional triplet in the path (i.e. the base location for VS-integrated vcpkg is not `vcpkg_installed`, but rather `vcpkg_installed\x64-windows`):
```
Discovered VCPKG package manifest file at: "C:\\git\\myrepository\\vcpkg_installed\\x64-windows\\vcpkg\\manifest-info.json"
...
No valid manifest-info.json found at either '"C:\\git\\myrepository\\vcpkg_installed\\vcpkg\\manifest-info.json"' or '"C:\\git\\myrepository\\vcpkg_installed\\manifest-info.json"' for base location '"C:\\git\\myrepository\\vcpkg_installed"'. Returning original recorder.
```
- I have confirmed that the additional triplet in the `vcpkg_installed` paths is by design (which, other than [vcpkg#23306](https://github.com/microsoft/vcpkg/issues/23306) and [comment in vcpkg#23023](https://github.com/microsoft/vcpkg/pull/23023#pullrequestreview-878288016), appears to be undocumented), so the vcpkg component detection should support that directory layout.

### Issue 2

Even with a `vcpkg_installed` layout that the vcpkg component detection understands, the detection does not attribute dependencies to the top-level `vcpkg.json`, so nothing shows up as Explicitly Referenced, and so the SPDX output is also missing the vcpkg dependencies:

- If I manually move the folders to the expected paths (up one level, eliminating the top-level triplet), it still doesn't result in any Explicitly Referenced vcpkg dependencies, though it does get rid of the errors in the `-V Verbose` log.

Start with the Vcpkg detector documentation and the supplied sbom-tool command, then use verbose output to trace discovery of vcpkg_installed\x64-windows\vcpkg\manifest-info.json. Inspect how the detector resolves the triplet layout and associates vcpkg.spdx.json entries with vcpkg.json. Done means dependencies are explicitly attributed and included in SPDX output for both layouts.

Written by the indexing model from the issue text.