fix(sbom): use root package for unknown dependencies (if exists) [b…

fix(sbom): use root package for unknown dependencies (if exists) [b… #454