fix(sbom): export empty dependencies in CycloneDX

[nikpivkin]

Description

According to the CycloneDx documentation: Components that do not have their own dependencies MUST be declared as empty elements within the graph.

Related issues

• Close CycloneDX JSON is invalid: dependencies.dependsOn is null #3663

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Thanks, @nikpivkin and @afdesk !