* Add SBOM.ClassifyScope for direct/transitive dependency scope

Walks the DEPENDS_ON/DESCRIBES relationship graph to tag each package as
a direct or transitive dependency of the document root. Roots are nodes
that originate DEPENDS_ON edges without being a target of one, plus
anything a DESCRIBES edge points at. Returns nil for flat-list SBOMs so
callers can distinguish no-graph from unclassified.

Also exports RelDependsOn/RelDescribes and replaces the three existing
string literals in the parsers with them.

* ClassifyScope: return empty (not nil) for rootless cycle

nil is reserved for the flat-list case (no DEPENDS_ON or DESCRIBES edges
at all). A DEPENDS_ON-only cycle where every node has an inbound edge is
still a graph, so return an empty map so callers can tell the two apart,
matching the doc comment. Also treat unrelated relationship types
(CONTAINS etc) as no-graph.