fix(sbom): attach nested packages to Application

[DmitriyLewen]

Description

There is a problem with decoding nested packages.
We create 2 attachments for them (see #8143).

This PR recursively checks all related packages and associates them with an attachment.

Example (test file packages:
Before:

➜ trivy -q rootfs -f cyclonedx -o report.cdx.json ./pkg/dependency/parser/golang/binary/testdata/test.elf && trivy -q sbom ./report.cdx.json -f json --list-all-pkgs | grep Target 
      "Target": "",
      "Target": "test.elf",

After:

➜ trivy -q rootfs -f cyclonedx -o report.cdx.json ./pkg/dependency/parser/golang/binary/testdata/test.elf && ./trivy -q sbom ./report.cdx.json -f json --list-all-pkgs | grep Target
      "Target": "test.elf",

Related issues

• Close bug(sbom): multiple Results for one package with root relationship for sbom mode #8143

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

These dependencies will be changed after #8104

So this should be changed in one of these PRs