CycloneDx: Include linkage type in the reports

[fviernau]

[fviernau]

How could the reprentation look like?

• There is an indication here, that subcomponent is for static linked components and dependencies for dynamic ones,
  see https://cyclonedx.slack.com/archives/C01DRP0543Y/p1698321654191629.
• This also matches the description of compontens[] property inside of a Component, see
  https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_components.

...that is, dynamically linked stuff falls under Sbom.dependencies whereas statically linked stuff goes into Component.components. Currently we have all underneath Sbom.dependencies and do not add any subcomponents at all.