Capture the dependency graph in CycloneDX BOMs

[sschuberth]

Since the CycloneDX 1.2 spec, the dependency graph moved from an extension to a core feature. So after https://github.com/oss-review-toolkit/ort/pull/3897 is merged, we could make use of it as the hierarchy of dependencies is valuable additional information.