fix(report): tidy dependencies for multiple repo on integration with GSA

[kl-sinclair]

What did you implement:

In case of multiple repository scan, dependency graph is included INCORRECTLY, because last scanned repo overwrite the others.
This PR tidies dependency by repository and manifest file, and set which repo the component come from in SBOM.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

$ vuls report -to-localfile -format-cyclonedx-json
or 
$ vuls report -to-localfile -format-cyclonedx-xml

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[kl-sinclair]

Sample SBOM output

https://gist.github.com/kl-sinclair/de86af7174591df5ebae0b89ca541e5e

blob path as lockfile name

  "components": [
    ...
    {
      "bom-ref": "99d637f3-21e8-4d9b-bcd7-4c8ad552b76b",
      "type": "application",
      "name": "/future-architect/vuls/blob/master/go.sum",
      "properties": [
        {
          "name": "future-architect:vuls:Type",
          "value": "gomod"
        }
      ]
    },
    ...

repo url in purl qualifier

    ...
    {
      "bom-ref": "pkg:gomod/cloud.google.com%2Fgo@v0.105.0?repo_url=https:%2F%2Fgh.neting.cc%2Ffuture-architect%2Fvuls\u0026file_path=go.sum",
      "type": "library",
      "name": "cloud.google.com/go",
      "version": "v0.105.0",
      "purl": "pkg:gomod/cloud.google.com%2Fgo@v0.105.0?repo_url=https:%2F%2Fgh.neting.cc%2Ffuture-architect%2Fvuls\u0026file_path=go.sum"
    },
    ...

[kotakanbe]

LGTM