fix(sbom): fix infinite loop for cyclonedx

[DmitriyLewen]

Description

when dependencies are cyclically dependent on each other.
e.g.:

➜  docker run -it --rm ubuntu 

root@0a467f393ce3:/# cat /var/lib/dpkg/status | grep "Package: libc6" -A 11
Package: libc6
...
Version: 2.35-0ubuntu3.1
Replaces: libc6-amd64
Depends: libgcc-s1, libcrypt1 (>= 1:4.4.10-10ubuntu4)

root@0a467f393ce3:/# cat /var/lib/dpkg/status | grep "Package: libcrypt1" -A 12
Package: libcrypt1
...
Version: 1:4.4.27-1
Replaces: libc6 (<< 2.29-4)
Depends: libc6 (>= 2.25)

libc6 => libcrypt1 and libcrypt1 => libc6.

For these cases Trivy gets infinity loops when trying to unmarshal cyclonedx file.

Related issues

• Close goroutine stack exceeds 1000000000-byte limit - trivy sbom 0.39.0 #3993

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).