fix: duplicate entries in cyclonedx dependency list

[kzantow]

This PR corrects an issue where Syft is not outputting CycloneDX dependencies properly -- instead of one entry for a unique Ref, it was outputting multiple entries with the same Ref, which is not valid. The spec states: "All items must be unique", which seems to indicate each entry has a unique Ref and the cyclonedx-cli validate fails.

With this change, the latest cyclonedx-cli indicates the BOM is now valid:

$ cyclonedx-cli validate --input-file alpine.cdx.json
BOM validated successfully.

Fixes: #2062

[github-actions]

Benchmark Test Results

Benchmark results from the latest changes vs base branch

goos: linux%0Agoarch: amd64%0Apkg: github.com/anchore/syft/test/integration%0Acpu: Intel(R) Xeon(R) CPU E5-2673 v4 @ 2.30GHz%0A                                                              │ ./.tmp/benchmark-a0a39b6.txt │%0A                                                              │            sec/op            │%0AImagePackageCatalogers/alpmdb-cataloger-2                                        14.44m ± 4%25%0AImagePackageCatalogers/apkdb-cataloger-2                                         888.9µ ± 3%25%0AImagePackageCatalogers/binary-cataloger-2                                        252.9µ ± 3%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                        776.0µ ± 2%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                    26.56µ ± 4%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                              131.2µ ± 2%25%0AImagePackageCatalogers/java-cataloger-2                                          21.79m ± 2%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                          130.7µ ± 9%25%0AImagePackageCatalogers/javascript-package-cataloger-2                            504.8µ ± 5%25%0AImagePackageCatalogers/nix-store-cataloger-2                                     374.7µ ± 4%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                        1.021m ± 2%25%0AImagePackageCatalogers/portage-cataloger-2                                       625.1µ ± 1%25%0AImagePackageCatalogers/python-package-cataloger-2                                4.173m ± 2%25%0AImagePackageCatalogers/r-package-cataloger-2                                     293.4µ ± 3%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                        708.8µ ± 3%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                  1.179m ± 5%25%0AImagePackageCatalogers/sbom-cataloger-2                                          148.8µ ± 2%25%0Ageomean                                                                          636.3µ%0A%0A                                                              │ ./.tmp/benchmark-a0a39b6.txt │%0A                                                              │             B/op             │%0AImagePackageCatalogers/alpmdb-cataloger-2                                       5.132Mi ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                        184.5Ki ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                       30.76Ki ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                       141.3Ki ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                   3.695Ki ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                             9.906Ki ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                         3.067Mi ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                         8.594Ki ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                           83.81Ki ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                    38.93Ki ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                       155.2Ki ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                      109.8Ki ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                               986.0Ki ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                    42.90Ki ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                       171.0Ki ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                 123.2Ki ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                         14.20Ki ± 0%25%0Ageomean                                                                         93.03Ki%0A%0A                                                              │ ./.tmp/benchmark-a0a39b6.txt │%0A                                                              │          allocs/op           │%0AImagePackageCatalogers/alpmdb-cataloger-2                                        88.06k ± 0%25%0AImagePackageCatalogers/apkdb-cataloger-2                                         4.034k ± 0%25%0AImagePackageCatalogers/binary-cataloger-2                                         866.0 ± 0%25%0AImagePackageCatalogers/dpkgdb-cataloger-2                                        2.911k ± 0%25%0AImagePackageCatalogers/dotnet-portable-executable-cataloger-2                     132.0 ± 0%25%0AImagePackageCatalogers/go-module-binary-cataloger-2                               281.0 ± 0%25%0AImagePackageCatalogers/java-cataloger-2                                          40.69k ± 0%25%0AImagePackageCatalogers/graalvm-native-image-cataloger-2                           228.0 ± 0%25%0AImagePackageCatalogers/javascript-package-cataloger-2                            1.264k ± 0%25%0AImagePackageCatalogers/nix-store-cataloger-2                                      820.0 ± 0%25%0AImagePackageCatalogers/php-composer-installed-cataloger-2                        3.844k ± 0%25%0AImagePackageCatalogers/portage-cataloger-2                                       2.194k ± 0%25%0AImagePackageCatalogers/python-package-cataloger-2                                16.14k ± 0%25%0AImagePackageCatalogers/r-package-cataloger-2                                      851.0 ± 0%25%0AImagePackageCatalogers/rpm-db-cataloger-2                                        3.914k ± 0%25%0AImagePackageCatalogers/ruby-gemspec-cataloger-2                                  2.291k ± 0%25%0AImagePackageCatalogers/sbom-cataloger-2                                           394.0 ± 0%25%0Ageomean                                                                          2.000k