fix(sbom): use root package for unknown dependencies (if exists)

fix(sbom): use root package for unknown dependencies (if exists) #12672