Dungeon1

**What happened**: Syft not created "dependencies" in cyclonedx report for Go, Rust, Java and etc. Cargo.lock had "dependencies". View like ``` [[package]] name = "yaserde" version = "0.8.0" source =...